CVE-2026-19709CWE-287

CVE-2026-19709

Medium · published August 19, 2026

CVSS v3.1

5.3

EPSS

Percentile

24.1

In the wild

Unconfirmed

What it is

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00323 · 24.1th percentile
Weakness: CWE-287 · Improper Authentication
Published: 2026-08-19T10:17Z

References (1)

https://wpscan.com/vulnerability/957888a4-bb11-42c6-930a-8c836170452b/ · [email protected]

EPSS history

Timeline

19 AUG 06:00Z
Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
cvelistv5