# Membership Plugin – Kadence Memberships <= 4.0.5 - Unauthenticated Missing Authorization to Database Maintenance Actions

- **ID:** WPSEC-2026-2993
- **Plugin:** Membership Plugin – Kadence Memberships (`restrict-content`), https://wordpress.org/plugins/restrict-content/
- **Affected versions:** from 3.0 before 4.0.6
- **Fixed in:** 4.0.6 (Update to 4.0.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/restrict-content
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2993/

## Description

The Membership Plugin – Kadence Memberships plugin for WordPress is vulnerable to unauthorized modification of data via the 'rcp-action' database maintenance actions in all versions up to, and including, 4.0.5, due to missing capability and nonce checks on the rcp_upgrade_table_collation and rcp_run_upgrade functions hooked to admin_init. This makes it possible for unauthenticated attackers to run ALTER TABLE statements that convert the plugin's membership level, discount and payment tables to the utf8 character set, which can corrupt stored data. When a legacy database upgrade is pending, they can also run the legacy upgrade routines.

## References

- https://wpsec.com/vuln/WPSEC-2026-2993/
- https://plugins.svn.wordpress.org/restrict-content/tags/4.0.6/
- https://wordpress.org/plugins/restrict-content/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2993/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.