Description

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T06:17:40.273Z",
  "pubdate": "2026-08-19T06:17:40.273Z",
  "executiveSummary": "The Membership For WooCommerce WordPress plugin before 3.1.2 suffers from an authorization bypass vulnerability affecting its REST API implementation. The root cause stems from improper authentication logic where the application fails to verify whether an API consumer secret has been generated prior to comparing it against user-supplied credentials in incoming requests. Consequently, unauthenticated remote attackers can successfully bypass authentication controls to interact with sensitive REST routes. The primary impact of this flaw is unauthorized information disclosure, specifically exposing detailed membership plan information for any registered user on the target system. This vulnerability affects instances where the plugin's API functionality has been enabled by administrators, but no consumer keys or secrets have actually been generated or assigned. The risk implication is moderate to high depending on data sensitivity, allowing unauthenticated attackers with network access to enumerate private user membership data without holding valid administrative or consumer credentials.",
  "technicalDetails": "The vulnerability resides within the REST API routing and authentication mechanism of the Membership For WooCommerce WordPress plugin, specifically affecting versions prior to 3.1.2. The vulnerable component handles incoming REST requests intended for membership management and data retrieval. The fundamental root cause of the vulnerability is a logic flaw in the authentication validation routine. When a request is made to the plugin's REST endpoints, the application attempts to validate the provided API consumer secret against the stored credential. However, the codebase fails to check if an API consumer secret has actually been initialized or generated in the database before executing the comparison logic. If no consumer secret exists, the comparison condition evaluates incorrectly or bypasses the necessary validation checks due to null, empty, or default value handling anomalies.\nNetwork exposure is external, as the vulnerable REST routes are accessible over HTTP/HTTPS to any remote attacker able to reach the WordPress REST API endpoints. The attack requires zero authentication and no prior privileges, meaning unauthenticated external entities can exploit the flaw. To execute the attack, an unauthorized actor crafts an HTTP request targeting the exposed plugin REST routes. Because the application does not verify the existence of a generated consumer secret, the request circumvents the intended authentication barrier. Upon successful traversal of the authentication check, the REST controller processes the query and returns sensitive data in the HTTP response payload. The post-exploitation impact includes the unauthorized harvesting and enumeration of user membership plan details, compromising user privacy and potentially providing reconnaissance data for further attacks against the WordPress installation."
}