The Membership Plugin – Restrict Content plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in versions up to 3.2.13. This vulnerability arises through the WordPress core search functionality, which can be leveraged by unauthenticated attackers to access sensitive data from posts that should be restricted to privileged roles such as administrators. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or remediation information is provided in the available data.

An unauthenticated attacker can access sensitive information intended only for higher-level roles by exploiting the WordPress core search feature in conjunction with the vulnerable Membership Plugin – Restrict Content. This exposure could lead to unauthorized disclosure of confidential data contained within restricted posts. There is no reported impact on integrity or availability, and no known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting or disabling the WordPress core search feature or limiting its access to authenticated users with appropriate roles to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.