Security Alert Summary
The Membership Plugin – Restrict Content plugin for WordPress contains a missing authentication check in the rcp_stripe_create_setup_intent_for_saved_card function in all versions up to and including 3.2.16. Because the plugin also fails to validate a user-controlled key, unauthenticated attackers may be able to retrieve Stripe SetupIntent client_secret values for memberships.
CVE Details
- CVE ID: CVE-2025-14844
- Affected component: The Membership Plugin – Restrict Content plugin for WordPress
- Affected versions: All versions up to and including 3.2.16 (as stated in the CVE entry)
- Published: January 16, 2026 at 10:16 AM UTC
- Last modified: January 16, 2026 at 3:55 PM UTC
- CVSS v3.1 base score: 8.2
- CVSS v3.1 severity: HIGH
- CVSS vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Authentication / privileges / user interaction: No authentication required (PR:N); privileges required: NONE; user interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-639 (as listed in the CVE entry)
Technical Details
The vulnerability is a missing authentication/capability check in the plugin’s Stripe integration. The CVE description identifies the specific function rcp_stripe_create_setup_intent_for_saved_card as lacking the required capability check. In addition, the plugin does not validate a user-controlled key. Together, these issues allow unauthenticated requests to obtain Stripe SetupIntent client_secret values associated with memberships.
The CVE entry references the plugin’s Stripe functions file (lines noted in the references). The core issue is the absence of an access-control check and inadequate validation of an input value that the attacker can control; as a result, sensitive Stripe SetupIntent client_secret values may be exposed.
How This Could Impact Your Website
On a typical site with multiple users—an owner, internal staff (e.g., site manager or developer), and external contributors—this vulnerability could allow an unauthenticated attacker to access Stripe SetupIntent client_secret values tied to membership records. While the CVE describes confidentiality impact rather than full site compromise, leaking these payment-related tokens can have practical consequences.
- An attacker with exposed SetupIntent client_secret values might be able to gain information useful for targeted phishing or social engineering campaigns against members or staff.
- Membership-related sensitive data could be inferred or correlated, increasing privacy risk for users and staff.
- Operational trust and customer confidence may be affected if payment-related tokens are disclosed, even if no direct financial loss is proven in the CVE entry.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site and development environments.
- Monitor site activity and logs for unusual behavior related to membership and payment endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://cwe.mitre.org/data/definitions/639.html
- https://docs.stripe.com/api/setup_intents/object
- https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.16/core/includes/gateways/stripe/functions.php#L848
- https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.16/core/includes/gateways/stripe/functions.php#L987
- https://plugins.trac.wordpress.org/changeset/3438168/restrict-content/tags/3.2.17/core/includes/gateways/stripe/functions.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0c28545d-c7cd-469f-bccf-90e8b52fd4e7?source=cve
