{
 "id": "WPSEC-2026-2994",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2994/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2994/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2994/index.md",
 "title": "Membership Plugin – Kadence Memberships <= 4.0.5 - Unauthenticated Insecure Direct Object Reference via Registration Payment ID",
 "description": "The Membership Plugin – Kadence Memberships plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'rcp_registration_payment_id' parameter in the rcp_send_registration_to_gateway function in all versions up to, and including, 4.0.5, due to missing validation that the posted payment belongs to the current user and matches the membership level being registered. This makes it possible for unauthenticated attackers to send other users' pending payments to the gateway, and to send a pending payment for one membership level to the gateway with the price of a different, cheaper level.",
 "plugin": {
  "slug": "restrict-content",
  "name": "Membership Plugin – Kadence Memberships",
  "full_name": "Membership Plugin – Kadence Memberships",
  "wordpress_org": "https://wordpress.org/plugins/restrict-content/",
  "advisories_url": "https://wpsec.com/vuln/plugin/restrict-content/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/restrict-content"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0",
    "from_inclusive": true,
    "to": "4.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0 before 4.0.6"
  ]
 },
 "introduced_in": "3.0",
 "fixed_in": "4.0.6",
 "remediation": "Update to 4.0.6 or later.",
 "fix_released": "2026-11-11T16:33:33+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:15:04.684153+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2994/",
  "https://plugins.svn.wordpress.org/restrict-content/tags/4.0.6/",
  "https://wordpress.org/plugins/restrict-content/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/restrict-content",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}