exploitDog

CVE-2025-14844

Опубликовано: 16 янв. 2026

Источник: nvd

CVSS3: 8.2

CVSS3: 7.5

EPSS Низкий

Описание

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_intent_for_saved_card' function due to missing capability check. Additionally, the plugin does not check a user-controlled key, which makes it possible for unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership.

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:liquidweb:restrict_content:*:*:*:*:*:wordpress:*:*

Версия до 3.2.17 (исключая)

EPSS

Процентиль: 47%

0.00245

Низкий

8.2 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-639

Связанные уязвимости

GHSA-c827-pf9p-24mm

CVSS3: 8.2

github

22 дня назад

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_intent_for_saved_card' function due to missing capability check. Additionally, the plugin does not check a user-controlled key, which makes it possible for unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership.

EPSS

Процентиль: 47%

0.00245

Низкий

8.2 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-639