CVE-2025-14844

CVE-2025-14844 is a high-severity missing authentication vulnerability affecting all versions up to 3.2.16 of the Membership Plugin – Restrict Content for WordPress. This flaw allows unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership due to a missing capability check in the 'rcp_stripe_create_setup_intent_for_saved_card' function and a lack of user-controlled key validation. With a CVSS score of 8.2 (HIGH), exploitation requires no authentication or user interaction, posing a significant risk of sensitive information disclosure. While there is no evidence of active exploitation or publicly available exploit modules like Metasploit or Nuclei, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.