Vulnerability record/PUBLISHED/Published Nov 15, 2026 06:00:07 UTC

CVE-2026-114452

The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing to another member's pending payment.

Base scoreN/A/ 10

SeverityNoneCVSS unscored

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityNone

No CVSS vector is available for this record.

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityWPScan

Last updatedNov 15, 2026 06:00:07 UTC

PublishedNov 15, 2026 06:00:07 UTC

ReservedOct 21, 2026 14:28:51 UTC

Credits

Het Kalariya
WPScan