CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
Unauthenticated attackers can bypass API authentication to disclose user membership details if the API is enabled but keys are not generated.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19709?
CVE-2026-19709 is a medium-severity authentication bypass vulnerability in Unknown Membership For WooCommerce, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.
Weakness: CWE-287
Which versions are affected by CVE-2026-19709?
How do I fix CVE-2026-19709?
No fix has been published for CVE-2026-19709 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-19709 being exploited?
There is no known exploitation of CVE-2026-19709 in the wild and no public exploit code.
Sources
Also known as GHSA-5c3c-g52p-xg2h.