Members <= 3.3.1 - Unauthenticated Private Site Mode Bypass via Login Page Query Variables
- ID
- WPSEC-2026-3144
- Plugin
- Members – Membership & User Role Editor Plugin (members)
- Affected
- from 3.2.28 before 3.3.2
- Remediation
- Update to 3.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-288
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-11-14
- Attack surface
- Members on WPSec AttackSurface
- Fix released
- Published
Description
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to a Private Site mode bypass via the login page exemption in all versions up to, and including, 3.3.1. The cause is that members_is_login_page_request() exempts a request from the private-site redirect when its path matches the login, lost password or registration URL, without checking that the main query actually resolved to the login page. This makes it possible for unauthenticated attackers to view content that Private Site mode limits to logged-in users. They do this by requesting the login path with extra query variables (such as 'pagename' or 'page_id') in the query string or POST body. Exploitation requires Private Site mode to be enabled and the site's login URL to be served from a front-end path.
References
- https://wpsec.com/vuln/WPSEC-2026-3144/
- https://plugins.svn.wordpress.org/members/tags/3.3.2/
- https://wordpress.org/plugins/members/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS