Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter

Description

The plugin does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the plugin's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark.