High · published January 16, 2026
⚡ Unauthenticated attackers can snag sensitive Stripe client secrets due to missing capabilities in the Membership Plugin – Restrict Content for WordPress! 🔥 Think of it like a hotel with no front desk: anyone can walk in and access the guest list without checking in. This flaw allows hackers to stroll right past security and grab membership payment secrets with no one the wiser! An attacker could exploit this vulnerability to leak Stripe SetupIntent client_secret values, jeopardizing the financial details of your memberships. This could lead to unauthorized access to premium content, causing your customers to lose trust and putting sensitive financial data at risk. It's a hefty blow to both security and reputation!
Think of it like a hotel with no front desk: anyone can walk in and access the guest list without checking in. This flaw allows hackers to stroll right past security and grab membership payment secrets with no one the wiser! This vulnerability occurs in versions of the Membership Plugin – Restrict Content up to 3.2.16, where the 'rcp_stripe_create_setup_intent_for_saved_card' function lacks proper authentication checks. As a result, unauthenticated users can leak sensitive Stripe keys tied to membership operations.
An attacker could exploit this vulnerability to leak Stripe SetupIntent client_secret values, jeopardizing the financial details of your memberships. This could lead to unauthorized access to premium content, causing your customers to lose trust and putting sensitive financial data at risk. It's a hefty blow to both security and reputation! To protect yourself, update the plugin to version 3.2.17 or later immediately. Additionally, consider implementing stricter access controls to ensure only authorized users can interact with sensitive functions. Regularly audit your plugins to prevent similar issues in the future! You've got this! Follow these steps, and you’ll make your site a fortress against unauthorized access! 🛡️