CVE-2026-114451
Received Received - Intake

Unauthenticated Database Schema Alteration in Membership Plugin

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: WPScan

Description
The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-114451
EUVD
EUVD-2026-125983

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Membership Plugin From 0 (inc) to 4.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Kadence Memberships WordPress plugin before version 4.0.6. It allows unauthenticated users to alter the plugin's database tables by downgrading the character set without proper authorization or CSRF checks. This change irreversibly replaces 4-byte characters like emoji and some CJK characters in membership levels, discount codes, and payment records with question marks.

Detection Guidance

Check if the Kadence Memberships plugin version is below 4.0.6 by inspecting the WordPress admin panel or using commands like 'wp plugin list' in WP-CLI. Look for unauthorized database changes by reviewing table character sets with SQL queries such as 'SHOW TABLE STATUS LIKE 'wp_rcp_%';'.

Impact Analysis

If exploited, this vulnerability can corrupt your WordPress membership data. Important information such as membership levels, discount codes, and payment records may become unreadable or permanently altered. This could disrupt your website's functionality and lead to data loss.

Compliance Impact

This vulnerability could impact compliance by corrupting or making personal data unreadable, potentially violating data integrity requirements under GDPR and HIPAA. If membership or payment records are altered, organizations may fail to maintain accurate and accessible records, leading to compliance violations.

Mitigation Strategies

Update the Kadence Memberships plugin to version 4.0.6 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review database backups to ensure no irreversible data corruption has occurred.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...