Memberful – Membership Plugin < 1.82.0 - Authenticated (Contributor+) Protected Post Content Disclosure

Description

The Memberful – Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.81.2. This is due to missing validation of whether the current render context is a full singular post view before applying paywall enforcement, allowing the full protected post body to be served in listing, excerpt, and related-post render contexts. This makes it possible for authenticated attackers, with contributor-level access and above, to access protected post content through archive listings, excerpts, or REST API contexts where the paywall was not properly enforced, retrieving body text that should be restricted to paying members.