{"id":"CVE-2026-19709","aliases":["EUVD-2026-62291","GHSA-5c3c-g52p-xg2h"],"status":"published","title":"Membership For WooCommerce \u003c 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass","description":"The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00323,"percentile":0.25534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-08-19T06:00:21Z","modified":"2026-10-22T16:09:59Z","products":[{"vendor":"unknown","product":"membership for woocommerce"},{"vendor":"wp swings","product":"membership for woocommerce"}],"references":[{"url":"https://wpscan.com/vulnerability/957888a4-bb11-42c6-930a-8c836170452b/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19709"},{"url":"https://wpscan.com/vulnerability/957888a4-bb11-42c6-930a-8c836170452b"},{"url":"https://github.com/advisories/GHSA-5c3c-g52p-xg2h"}],"sources":{"cve":[{"id":"CVE-2026-19709","title":"Membership For WooCommerce \u003c 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass","description":"The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.","status":"published","published":"2026-08-19T06:00:21.457Z","modified":"2026-08-19T16:38:02.711Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-62291","description":"The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.","status":"published","published":"2026-08-19T06:00:21Z","modified":"2026-08-19T16:38:02Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:41.405951Z"}],"ghsa":[{"id":"GHSA-5c3c-g52p-xg2h","title":"The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer...","description":"The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.","status":"published","published":"2026-08-19T06:31:18Z","modified":"2026-08-19T18:32:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:10:43.503566Z"}],"nvd":[{"id":"CVE-2026-19709","description":"The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.","status":"published","published":"2026-08-19T06:17:40.273Z","modified":"2026-10-22T16:09:59.56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:39.620837Z"}]}}