How Two WordPress Blocks Got Around the Members Plugin's Content Restrictions

Members lets a WordPress site keep posts for certain people only: paying members, clients, staff. We reported three issues to Caseproof, the company behind Members and MemberPress, and they fixed all three in version 3.3.1.

When the fixes came out, we posted a short notice asking site owners to update and left out the details. Caseproof's advisories now describe each issue in full, so here is what was wrong, in plain terms, and what it means if you keep private content on a WordPress site.

The short version

• Two issues let any visitor read restricted content. Posts and comments limited to a role could be read by someone who wasn't signed in, through two standard WordPress blocks: Latest Posts and Latest Comments.
• One issue could take pages offline. A user with Author access could save a post in a way that made every page showing it fail to load for most visitors.
• All three are fixed in Members 3.3.1, released October 30, 2026. If your site runs Members, update it.

Timeline

We sent the three reports to Caseproof as private GitHub security advisories late on October 29. The next morning Caseproof confirmed them, released Members 3.3.1, credited us in the WordPress.org changelog and published the advisories.

Going from report to released fix in about ten hours is unusually fast. Caseproof's handling is a good example of how disclosure is meant to work.

Issue 1: restricted posts in the Latest Posts block

Members lets you restrict a post to one or more roles, so that only people with that role can read it. It does this by checking each post as WordPress prepares it for display, and swapping in a "you don't have permission" message for anyone who isn't allowed.

That check only works if the page goes through the usual display steps. The Latest Posts block, which lists recent posts on any page you put it on, has a setting to show each post's full content. In that mode, the block reads each post's stored text directly instead of going through the usual display steps, so Members never got the chance to check it.

The result: a page with a Latest Posts block set to full content showed the complete text of members-only posts to anyone who opened it, signed in or not. The same block in excerpt mode was protected, because excerpts do go through the steps Members watches.

• Who was affected: sites using Members' Content Permissions together with a Latest Posts block set to full content on a public page.
• Severity: 5.3Medium CVSS 3.1, from Caseproof's advisory.

Issue 2: comments on restricted posts in the Latest Comments block

The second issue had the same root cause, through a different block. Members hides the comments on a restricted post, but the Latest Comments block, which lists recent comments from across the site, showed them anyway.

It failed in two ways, one for each display mode. In excerpt mode, the block read the comment text directly, so Members was never asked. In full mode, Members was asked, but it checked whether the visitor could see the page holding the block, not the restricted post the comment belonged to. Since that page was public, the answer was always yes.

So a visitor could read comments left on members-only posts, along with each restricted post's title and link.

• Who was affected: sites using Content Permissions with a Latest Comments block on a public page.
• Severity: 5.3Medium CVSS 3.1, from Caseproof's advisory.

Issue 3: a block setting that could break pages

Members includes an optional Block Permissions add-on, which shows or hides individual blocks inside a post depending on who is viewing, with an optional message for those who can't see them. The plugin expected that message to always be plain text and never checked.

A user with Author access could save a block whose message wasn't text. From then on, every page that displayed that post failed with a critical error for every visitor the block was hidden from: the post itself, the home page if the post appeared there, search results and lists of recent posts. The people the block was meant for, often editors and administrators, still saw the site working normally, which made it easy to miss.

• Who was affected: sites with the Block Permissions add-on switched on and at least one user with Author access (or a Contributor whose post an editor publishes).
• Severity: 6.5Medium CVSS 3.1, from Caseproof's advisory.

The common thread

Members protected content at the point where WordPress displays it. That works for the ways the plugin's authors expected content to be shown. Blocks added new ways to show the same content, and each one that skipped the usual steps became a way around the restriction.

This isn't unique to Members. Any plugin that hides content by filtering what gets displayed has to keep up with every new way WordPress, a theme or another plugin can display it. That's why we test restriction plugins the way a visitor would: signed out, looking at every page that lists or summarizes content, not just the protected post itself.

What to do

• Update Members to 3.3.1 or later. It needs PHP 8.0 or newer. If the update won't install, ask your web host which PHP version your site runs.
• Look for the two blocks. Check whether any public page uses a Latest Posts block set to show full content, or a Latest Comments block, on a site where you restrict content.
• Check it signed out. Open those pages in a private browser window, where you aren't signed in, and confirm restricted posts show the permission message.
• Think about what was exposed. If all three conditions above were true, anything in those restricted posts or comments that shouldn't be public, such as a password, a private link or client details, is worth changing or removing.

Why we look at plugins like this

We look for security problems in the software small businesses rely on, report them privately to the people who make it, and publish details only after they're fixed. You can see our other credits and disclosures on our security research page.

If your business keeps content for members, clients or staff on its website and you want to know it stays private, that's the kind of thing a penetration test checks.