Medium severity · published Jun 4, 2026
CVE-2026-49077
WordPress WP eMember plugin <= v10.2.2 - Sensitive Data Exposure vulnerability
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Data.
This issue affects WP eMember: from n/a through v10.2.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
WP eMember · Tips and Tricks HQ
through v10.2.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49077
patchstack.com
https://patchstack.com/database/wordpress/plugin/wp-emember/vulnerability/wordpress-wp-emember-plugin-v10-2-2-sensitive-data-exposure-vulnerability?_s_id=cve
More from WP eMember
9.3
CVE-2026-54811
WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability
7.1
CVE-2026-28073
WordPress WP eMember theme <= v10.2.2 - Reflected Cross Site Scripting (XSS) vulnerability
6.8
CVE-2024-5744
WP eMember < 10.6.7 - Reflected XSS
6.8
CVE-2024-5077
WP eMember < 10.6.6 - Stored XSS in Blacklist via CSRF
5.3
CVE-2026-28070
WordPress WP eMember plugin <= v10.2.2 - Broken Access Control vulnerability