Vulnerabilities / Membership Plugin – Kadence Memberships
Membership Plugin – Kadence Memberships vulnerabilities
Advisories WPSec published for Membership Plugin – Kadence Memberships. Other sources may list more. Its attack surface: Membership Plugin – Kadence Memberships on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-11-12 | WPSEC-2026-2994 | Membership Plugin – Kadence Memberships <= 4.0.5 - Unauthenticated Insecure Direct Object Reference via Registration Payment ID | Medium 5.3 | 4.0.6 |
| 2026-11-12 | WPSEC-2026-2993 | Membership Plugin – Kadence Memberships <= 4.0.5 - Unauthenticated Missing Authorization to Database Maintenance Actions | Medium 5.3 | 4.0.6 |
| 2026-11-12 | WPSEC-2026-2992 | Membership Plugin – Kadence Memberships <= 4.0.5 - Authenticated (Subscriber+) Membership Level Manipulation via Renewal Registration | Medium 4.3 | 4.0.6 |
| 2026-11-12 | WPSEC-2026-2991 | Membership Plugin – Kadence Memberships <= 4.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference via Stripe Saved Card Setup | Medium 4.3 | 4.0.6 |
License: CC BY 4.0