CVE-2026-114451

Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter

View on CVE.org
Published Nov 15, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark.
Title Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter
References

Subscriptions

No data.

Weaknesses

No weakness.

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Nov 15, 2026, 6:00 AM
Reserved
Oct 21, 2026, 2:28 PM

View source JSON

No data.

No data.

No data.

No data.