Access Control Flaw in Membership Plugin for WordPress
CVE-2026-114452

Currently unrated

Key Information:

Vendor

WordPress
Status
Membership Plugin
Vendor
CVE Published:
15 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-114452?

The Membership Plugin for WordPress prior to version 4.0.6 contains a significant access control vulnerability. It fails to ensure that the membership referenced in a saved-card payment request belongs to the user making the request. This flaw allows subscribers to potentially access and disclose another member's Stripe payment client secret. Additionally, it permits them to attach a payment method of their choosing to another member's pending transaction, thereby compromising the integrity of payment processing and user data.

Affected Version(s)

Membership Plugin 3.2.17 < 4.0.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-114452 - Proof of Concept

References

https://wpscan.com/vulnerability/2694318a-07b5-483c-a3f1-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Het Kalariya
WPScan
.