{
 "id": "WPSEC-2026-3144",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3144/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3144/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3144/index.md",
 "title": "Members <= 3.3.1 - Unauthenticated Private Site Mode Bypass via Login Page Query Variables",
 "description": "The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to a Private Site mode bypass via the login page exemption in all versions up to, and including, 3.3.1. The cause is that members_is_login_page_request() exempts a request from the private-site redirect when its path matches the login, lost password or registration URL, without checking that the main query actually resolved to the login page. This makes it possible for unauthenticated attackers to view content that Private Site mode limits to logged-in users. They do this by requesting the login path with extra query variables (such as 'pagename' or 'page_id') in the query string or POST body. Exploitation requires Private Site mode to be enabled and the site's login URL to be served from a front-end path.",
 "plugin": {
  "slug": "members",
  "name": "Members",
  "full_name": "Members – Membership & User Role Editor Plugin",
  "wordpress_org": "https://wordpress.org/plugins/members/",
  "advisories_url": "https://wpsec.com/vuln/plugin/members/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/members"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-288"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.2.28",
    "from_inclusive": true,
    "to": "3.3.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.2.28 before 3.3.2"
  ]
 },
 "introduced_in": "3.2.28",
 "fixed_in": "3.3.2",
 "remediation": "Update to 3.3.2 or later.",
 "fix_released": "2026-11-13T19:38:32+00:00",
 "published": "2026-11-14T19:41:53+00:00",
 "updated": "2026-11-14T16:16:50.951726+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3144/",
  "https://plugins.svn.wordpress.org/members/tags/3.3.2/",
  "https://wordpress.org/plugins/members/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/members",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-11-14"
 }
}