Vulnerabilities / Membership Plugin – Kadence Memberships / WPSEC-2026-2994
Membership Plugin – Kadence Memberships <= 4.0.5 - Unauthenticated Insecure Direct Object Reference via Registration Payment ID
Medium 5.3
CWE-639Fixed in 4.0.6
- ID
- WPSEC-2026-2994
- Plugin
- Membership Plugin – Kadence Memberships (restrict-content)
- Affected
- from 3.0 before 4.0.6
- Remediation
- Update to 4.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Membership Plugin – Kadence Memberships on WPSec AttackSurface
- Fix released
- Published
Description
The Membership Plugin – Kadence Memberships plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'rcp_registration_payment_id' parameter in the rcp_send_registration_to_gateway function in all versions up to, and including, 4.0.5, due to missing validation that the posted payment belongs to the current user and matches the membership level being registered. This makes it possible for unauthenticated attackers to send other users' pending payments to the gateway, and to send a pending payment for one membership level to the gateway with the price of a different, cheaper level.
References
- https://wpsec.com/vuln/WPSEC-2026-2994/
- https://plugins.svn.wordpress.org/restrict-content/tags/4.0.6/
- https://wordpress.org/plugins/restrict-content/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS