CVE-2026-12426 describes a sensitive information exposure vulnerability in the Members – Membership & User Role Editor Plugin for WordPress, affecting all versions up to and including 3.2.22. The issue arises from the members_filter_protected_posts_for_rest functionality, which allows unauthenticated attackers to determine the existence and exact count of access-restricted posts. By leveraging per-page pagination as a boolean oracle, attackers can infer keywords and content from these restricted posts, potentially leaking sensitive information. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with no integrity or availability impact, and requires no privileges or user interaction for exploitation.

An unauthenticated attacker can extract information about the existence and number of access-restricted posts and infer content details from those posts. This leads to unauthorized disclosure of sensitive information, potentially compromising confidentiality of restricted content. There is no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users of the plugin should monitor the vendor's communications for updates and apply any released patches promptly once available. Until then, consider restricting access to the REST API endpoints or disabling the affected feature if feasible.