CVE-2026-104401
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Exposure of sensitive system information vulnerability in Memberful - Membership Plugin up to version 1.81.2. Allows retrieval of embedded sensitive data.
Risk Assessment
Disclosure of sensitive data may lead to confidentiality breach or further attacks.
Recommendation
Update the Memberful - Membership Plugin to the latest version and restrict data access.
Other vulnerabilities in Memberful - Membership Plugin
See all- CVE-2026-103067High
The Memberful - Membership Plugin (memberful-wp) for WordPress is vulnerable to Cross-Site Request Forgery (CSRF). The issue affects versions from n/a through 1.81.0.
- CVE-2025-58000Medium
The Memberful WordPress plugin (versions up to 1.75.0) has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS