CSRF Vulnerability in Membership Plugin for WordPress
CVE-2026-114451

Currently unrated

Key Information:

Vendor

WordPress
Status
Membership Plugin
Vendor
CVE Published:
15 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-114451?

The Membership Plugin for WordPress prior to version 4.0.6 lacks essential authorization and CSRF checks. This oversight allows unauthenticated users to execute a schema-altering database maintenance process, leading to potential data corruption. Specifically, it permits these users to alter the plugin's database tables, resulting in the irreversible loss of 4-byte characters—like emojis and certain Asian characters—replacing them with question marks in membership levels, discount codes, and payment records. This vulnerability emphasizes the importance of implementing robust access control measures to safeguard database integrity.

Affected Version(s)

Membership Plugin 0 < 4.0.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-114451 - Proof of Concept

References

https://wpscan.com/vulnerability/74c09864-9f3e-4201-84ed-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naoki Kawahigashi
WPScan
.