CVE-2026-12426

mediumCVSS 5.3covered by 1 sourcefirst seen 2026-07-11

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.

⚡ Watch CVE-2026-12426

Get an email if CVE-2026-12426 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumCVE-2026-12426: The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensi…nvd · 2026-07-11

External references

NVD record for CVE-2026-12426

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-12426 status](https://www.csirts.com/badge/CVE-2026-12426)](https://www.csirts.com/cve/CVE-2026-12426)