CVE WATCH / VULNERABILITY DETAIL
CVE-2026-114452
UNKNOWNCVSS 0NVD feed
Published 15 November 2026 · tracked since 15 November 2026
Description
The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog