CVE-2025-14844

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-14844
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_intent_for_saved_card' function due to missing capability check. Additionally, the plugin does not check a user-controlled key, which makes it possible for unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cwe.mitre.org/data/definitions/639.html Technical Description
https://docs.stripe.com/api/setup_intents/object Product
https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.16/core/includes/gateways/stripe/functions.php#L848 Product
https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.16/core/includes/gateways/stripe/functions.php#L987 Product
https://plugins.trac.wordpress.org/changeset/3438168/restrict-content/tags/3.2.17/core/includes/gateways/stripe/functions.php Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/0c28545d-c7cd-469f-bccf-90e8b52fd4e7?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:liquidweb:restrict_content:*:*:*:*:*:wordpress:*:*
History

23 Jan 2026, 17:09

Type Values Removed Values Added
First Time Liquidweb restrict Content
Liquidweb
CPE cpe:2.3:a:liquidweb:restrict_content:*:*:*:*:*:wordpress:*:*
References () https://cwe.mitre.org/data/definitions/639.html - () https://cwe.mitre.org/data/definitions/639.html - Technical Description
References () https://docs.stripe.com/api/setup_intents/object - () https://docs.stripe.com/api/setup_intents/object - Product
References () https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.16/core/includes/gateways/stripe/functions.php#L848 - () https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.16/core/includes/gateways/stripe/functions.php#L848 - Product
References () https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.16/core/includes/gateways/stripe/functions.php#L987 - () https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.16/core/includes/gateways/stripe/functions.php#L987 - Product
References () https://plugins.trac.wordpress.org/changeset/3438168/restrict-content/tags/3.2.17/core/includes/gateways/stripe/functions.php - () https://plugins.trac.wordpress.org/changeset/3438168/restrict-content/tags/3.2.17/core/includes/gateways/stripe/functions.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/0c28545d-c7cd-469f-bccf-90e8b52fd4e7?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/0c28545d-c7cd-469f-bccf-90e8b52fd4e7?source=cve - Third Party Advisory

16 Jan 2026, 10:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-16 10:16

Updated : 2026-01-23 17:09

NVD link : CVE-2025-14844

Mitre link : CVE-2025-14844

CVE.ORG link : CVE-2025-14844

JSON object : View

Products Affected

liquidweb

  • restrict_content
CWE
CWE-639

Authorization Bypass Through User-Controlled Key