CVE-2026-114452

The Kadence Memberships WordPress plugin (versions 3.2.17 through 4.0.5 ) contains an Insecure Direct Object Reference (IDOR) vulnerability. The flaw stems from a failure to verify that a membership referenced in a saved-card payment request actually belongs to the requesting user. This allows su...