CVE-2026-12426: WordPress Members Plugin Info Disclosure

CVE-2026-12426 Overview

CVE-2026-12426 is a sensitive information exposure vulnerability in the Members – Membership & User Role Editor Plugin for WordPress. The flaw affects all versions up to and including 3.2.22 and resides in the members_filter_protected_posts_for_rest function. Unauthenticated attackers can query the WordPress REST API to determine the existence and exact count of access-restricted posts. Attackers can further abuse per-page pagination as a boolean oracle to infer keywords and content within hidden restricted posts. The weakness is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate protected posts and infer restricted content via REST API pagination oracles, undermining the plugin's core content-gating purpose.

Affected Products

Members – Membership & User Role Editor Plugin for WordPress, all versions through 3.2.22
WordPress sites relying on the plugin for content access restriction
Membership sites using the plugin's private-site and content-permission features

Discovery Timeline

2026-07-11 - CVE-2026-12426 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-12426

Vulnerability Analysis

The Members plugin enforces content restrictions on WordPress posts based on user roles. The plugin registers a REST API filter, members_filter_protected_posts_for_rest, intended to prevent restricted posts from being returned to unauthorized callers. The filter removes protected post content from responses but does not fully hide the existence of those posts from REST query metadata. Response fields such as total post counts and pagination headers continue to reflect restricted items. An unauthenticated attacker querying the WordPress REST endpoints can therefore observe the true number of restricted posts and detect changes when search parameters match hidden content.

Root Cause

The root cause lies in filtering results after the query executes rather than restricting the underlying database query. The relevant logic in inc/functions-content-permissions.php and inc/functions-private-site.php strips content from the response payload, but the WordPress query object still counts and paginates restricted posts. Response totals, X-WP-Total headers, and pagination boundaries leak the presence of hidden entries. This mismatch between query execution and response filtering produces an observable side channel.

Attack Vector

Exploitation requires only network access to the WordPress REST API and no authentication. An attacker issues repeated requests to endpoints such as /wp-json/wp/v2/posts with varying search, per_page, and page parameters. By comparing returned totals and page counts, the attacker builds a boolean oracle: if a search term produces a higher total than the visible post set, the term matches a hidden restricted post. Iterating the search across a dictionary reveals keywords contained in protected content. No exploit code is publicly available at the time of publication, and the vulnerability is not listed in the CISA KEV catalog. See the Wordfence Vulnerability Report and the WordPress Change Set for technical details.

Detection Methods for CVE-2026-12426

Indicators of Compromise

High volumes of unauthenticated requests to /wp-json/wp/v2/posts with rotating search query parameters from a single source
Repeated REST API requests iterating per_page and page values against post endpoints
Anomalous growth in access log entries containing wp-json from non-browser user agents
Discrepancies between publicly visible post counts and totals reported by X-WP-Total response headers observed by monitoring tooling

Detection Strategies

Alert on unauthenticated REST API requests exceeding a baseline request rate per source IP against /wp-json/wp/v2/posts
Correlate sequential requests that vary only the search parameter, indicating dictionary-style enumeration
Inspect web application firewall (WAF) logs for pagination probing patterns targeting WordPress REST endpoints

Monitoring Recommendations

Enable verbose WordPress REST API access logging and forward logs to a centralized analytics platform
Monitor for spikes in wp-json traffic and unusual search parameter entropy
Track plugin versions across managed WordPress fleets and flag installations running 3.2.22 or earlier

How to Mitigate CVE-2026-12426

Immediate Actions Required

Update the Members – Membership & User Role Editor Plugin to a version later than 3.2.22 as soon as a patched release is available
Audit REST API access logs for enumeration activity against /wp-json/wp/v2/posts since publication
Restrict unauthenticated access to the WordPress REST API where business requirements allow

Patch Information

The vendor has released code changes tracked in the WordPress Change Set that modify members_filter_protected_posts_for_rest. Administrators should upgrade to the fixed release referenced in the Wordfence Vulnerability Report. Review the pre-patch source at functions-content-permissions.php L337 and functions-private-site.php L42 to confirm the vulnerable code paths in your deployment.

Workarounds

Disable the WordPress REST API for unauthenticated users using a security plugin or custom filter on rest_authentication_errors
Deploy WAF rules that rate-limit and inspect search parameter variability against /wp-json/wp/v2/posts
Temporarily unpublish highly sensitive restricted posts until the patched plugin version is deployed
Remove or replace the Members plugin with an alternative access control mechanism if patching is not feasible

bash

# Example: disable REST API for unauthenticated users via mu-plugin
# /wp-content/mu-plugins/disable-anonymous-rest.php
add_filter( 'rest_authentication_errors', function( $result ) {
    if ( ! is_user_logged_in() ) {
        return new WP_Error(
            'rest_forbidden',
            'REST API restricted to authenticated users.',
            array( 'status' => 401 )
        );
    }
    return $result;
});