CVE-2026-114452
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 15, 2026
Vendor
unknown
Description
The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing to another member's pending payment.