CVE-2026-2363 is an SQL Injection vulnerability in the WP-Members Membership Plugin for WordPress, affecting versions up to 3.5.5.1. The issue arises from improper neutralization of special elements in the 'order_by' attribute of the [wpmem_user_membership_posts] shortcode, allowing authenticated users with Contributor-level privileges or higher to append malicious SQL commands. This occurs because user input is not sufficiently escaped or prepared before being included in SQL queries, enabling unauthorized data extraction from the database.

Successful exploitation allows an authenticated user with Contributor-level access or above to extract sensitive information from the database. The vulnerability does not affect data integrity or availability but compromises confidentiality. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access where possible and monitor for suspicious activity related to the 'order_by' attribute usage. Avoid using the vulnerable shortcode or sanitize inputs manually if feasible.