CVE-2026-12426— Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| supercleanse | Members – Membership & User Role Editor Plugin | ≤ 3.2.22 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12426
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| supercleanse | Members – Membership & User Role Editor Plugin | 0 ~ 3.2.22 | - |
II. Public POCs for CVE-2026-12426
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12426
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-12426 (4)
Vendor Advisories for CVE-2026-12426 (1)
IV. Related Vulnerabilities
Same vendor: supercleanse
Same weakness: CWE-200
- CVE-2026-56336
Capgo - Information Disclosure via Unauthenticated SSO check - CVE-2026-56259
Crawl4AI - LLM Credential Exfiltration via base_url and Envi - CVE-2026-56238
Capgo - Unauthenticated Information Disclosure via PostgREST - CVE-2026-61454
Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ - CVE-2026-61426
PraisonAI before 1.7.3 Unauthenticated Agent Access via Inse
V. Comments for CVE-2026-12426
No comments yet