CVE-2026-19709: CWE-287 Improper Authentication in Membership For WooCommerce
Membership For WooCommerce plugin versions before 3.1.2 have an authentication flaw where the plugin does not verify if an API consumer secret exists before comparing it to the request. This allows unauthenticated attackers to access REST API routes and disclose membership plan details of any user on sites with the API enabled but no keys generated.
AI Analysis
Technical Summary
CVE-2026-19709 describes an improper authentication vulnerability (CWE-287) in the Membership For WooCommerce WordPress plugin prior to version 3.1.2. The flaw occurs because the plugin fails to check whether an API consumer secret has been generated before comparing it against the secret supplied in incoming requests. As a result, if the API is enabled but no keys have been generated, unauthenticated attackers can access REST API endpoints and retrieve membership plan details for any user.
Potential Impact
The vulnerability allows unauthenticated attackers to disclose membership plan details of any user via the REST API on affected sites where the API is enabled but no consumer keys have been generated. This leads to information disclosure but does not impact integrity or availability.
Mitigation Recommendations
Upgrade the Membership For WooCommerce plugin to version 3.1.2 or later, where this authentication check issue is fixed. Until patched, ensure that API keys are generated and managed properly to prevent unauthenticated access. No official patch link is provided in the data, so verify with the vendor for the official fix.
CVE-2026-19709: CWE-287 Improper Authentication in Membership For WooCommerce
Description
Membership For WooCommerce plugin versions before 3.1.2 have an authentication flaw where the plugin does not verify if an API consumer secret exists before comparing it to the request. This allows unauthenticated attackers to access REST API routes and disclose membership plan details of any user on sites with the API enabled but no keys generated.
CVSS v3.1
Score 5.3medium
Affected software
Membership For WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19709 describes an improper authentication vulnerability (CWE-287) in the Membership For WooCommerce WordPress plugin prior to version 3.1.2. The flaw occurs because the plugin fails to check whether an API consumer secret has been generated before comparing it against the secret supplied in incoming requests. As a result, if the API is enabled but no keys have been generated, unauthenticated attackers can access REST API endpoints and retrieve membership plan details for any user.
Potential Impact
The vulnerability allows unauthenticated attackers to disclose membership plan details of any user via the REST API on affected sites where the API is enabled but no consumer keys have been generated. This leads to information disclosure but does not impact integrity or availability.
Mitigation Recommendations
Upgrade the Membership For WooCommerce plugin to version 3.1.2 or later, where this authentication check issue is fixed. Until patched, ensure that API keys are generated and managed properly to prevent unauthenticated access. No official patch link is provided in the data, so verify with the vendor for the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-13T09:53:28.255Z
- State
- PUBLISHED
Threat ID: 6a854e95c6e8be033248b2cf
Added to database: 08/19/2026, 06:35:01 UTC
Last enriched: 09/11/2026, 09:47:57 UTC
Last updated: 10/02/2026, 02:46:03 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.