Membership Plugin – Kadence Memberships <= 4.0.5 - Unauthenticated Missing Authorization to Database Maintenance Actions
- ID
- WPSEC-2026-2993
- Plugin
- Membership Plugin – Kadence Memberships (restrict-content)
- Affected
- from 3.0 before 4.0.6
- Remediation
- Update to 4.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Membership Plugin – Kadence Memberships on WPSec AttackSurface
- Fix released
- Published
Description
The Membership Plugin – Kadence Memberships plugin for WordPress is vulnerable to unauthorized modification of data via the 'rcp-action' database maintenance actions in all versions up to, and including, 4.0.5, due to missing capability and nonce checks on the rcp_upgrade_table_collation and rcp_run_upgrade functions hooked to admin_init. This makes it possible for unauthenticated attackers to run ALTER TABLE statements that convert the plugin's membership level, discount and payment tables to the utf8 character set, which can corrupt stored data. When a legacy database upgrade is pending, they can also run the legacy upgrade routines.
References
- https://wpsec.com/vuln/WPSEC-2026-2993/
- https://plugins.svn.wordpress.org/restrict-content/tags/4.0.6/
- https://wordpress.org/plugins/restrict-content/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS