Membership For WooCommerce accepts an empty API secret and exposes membership records
Membership For WooCommerce before 3.1.2 compares a request secret without first confirming that the site generated an API consumer secret. On a site where the API is enabled but no keys were created, an unauthenticated request can pass that check, reach the plugin's REST routes and disclose any user's membership-plan details.
- Component
- Membership For WooCommerce
- Plugin slug
membership-for-woocommerce- Affected
- < 3.1.2
- Safe version
3.1.2- Published
- Aug 19, 2026
This CVE was published Aug 19, 2026 and is one of 7 known issues for this plugin.
Update, patch or deactivate.
Update Membership For WooCommerce to 3.1.2 or later. Disable the API until updated and assess exposure of customer membership information.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N