Paid Member Subscriptions CVE-2026-105317

Exploitation requires an authenticated subscriber-level WordPress account (CVSS PR:L) on a site running Paid Member Subscriptions version 3.1.1 or earlier; no user interaction (UI:N) and no high privileges are needed. The practical limiting factor is the account requirement - however, this plugin exists to provide open self-service membership registration, so obtaining a subscriber account is typically low-effort on default deployments. There is no indication of a non-default configuration dependency in the description; the primary constraints are the vulnerable version ceiling and possession of any valid low-tier account.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) describes a network-reachable, low-complexity SQL injection (CWE-89) requiring only low privileges - consistent with the 'Subscriber' label, meaning any authenticated subscriber-level account can exploit it. This is a meaningful mitigating factor: exploitation is NOT unauthenticated, but Paid Member Subscriptions is a membership plugin whose core purpose is to let visitors self-register for subscriber accounts, so the PR:L barrier is often trivially satisfied in production. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is currently a high-CVSS finding driven by vector severity rather than confirmed real-world weaponization. The scope-change (S:C) and C:H rating indicate Patchstack assessed the injection as able to read data beyond the plugin's own authorization boundary (e.g. the full WordPress database including user hashes). One signal to verify: the vendor rates integrity I:N and availability only A:L, which is narrower than a typical fully-exploitable SQLi - this suggests a read-oriented/blind injection rather than stacked write queries, but the exact injection mechanics are not detailed in the single available reference and should be confirmed against the Patchstack advisory.

An attacker self-registers (or uses an existing low-tier subscriber account) on a WordPress site running Paid Member Subscriptions <= 3.1.1, then sends a crafted request to a plugin endpoint placing malicious SQL into a parameter that is concatenated into a database query. Because the injection crosses the scope boundary (S:C, C:H), the attacker can read sensitive database contents such as other members' data and WordPress user credential hashes. No public exploit code was identified at time of analysis, and low attack complexity (AC:L) means no special timing or race conditions are required.