# Members <= 3.3.1 - Unauthenticated Private Site Mode Bypass via Login Page Query Variables

- **ID:** WPSEC-2026-3144
- **Plugin:** Members – Membership & User Role Editor Plugin (`members`), https://wordpress.org/plugins/members/
- **Affected versions:** from 3.2.28 before 3.3.2
- **Fixed in:** 3.3.2 (Update to 3.3.2 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-288
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/members
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3144/

## Description

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to a Private Site mode bypass via the login page exemption in all versions up to, and including, 3.3.1. The cause is that members_is_login_page_request() exempts a request from the private-site redirect when its path matches the login, lost password or registration URL, without checking that the main query actually resolved to the login page. This makes it possible for unauthenticated attackers to view content that Private Site mode limits to logged-in users. They do this by requesting the login path with extra query variables (such as 'pagename' or 'page_id') in the query string or POST body. Exploitation requires Private Site mode to be enabled and the site's login URL to be served from a front-end path.

## References

- https://wpsec.com/vuln/WPSEC-2026-3144/
- https://plugins.svn.wordpress.org/members/tags/3.3.2/
- https://wordpress.org/plugins/members/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3144/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.