CVE-2026-104401: Exposure of Sensitive System Information to an Unauthorized Control Sphere in Memberful Memberful - Membership Plugin

This vulnerability in the Memberful - Membership Plugin (versions >=0 <1.82.0) permits exposure of sensitive system information to an unauthorized control sphere. The issue allows retrieval of embedded sensitive data without proper authorization. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact.

An attacker with low privileges can remotely retrieve sensitive system information embedded within the plugin, potentially aiding further attacks or information gathering. The confidentiality impact is limited, with no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the plugin and monitor for unusual activity related to information exposure.