EUVD-2026-108138
GHSA-v7m5-rm64-m85p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable plugin endpoint
-
ExploitBypass missing authorization check
-
ImpactRead or modify restricted member data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must run the Paid Member Subscriptions plugin for WordPress at version 3.1.2 or earlier. The CVSS vector rates this unauthenticated (PR:N) with no user interaction, implying exploitation against a reachable site without credentials; however, the description attributes the flaw to 'Incorrectly Configured Access Control Security Levels,' and the sources do not specify the exact endpoint, request, or whether a particular membership/access-level configuration is required, so the precise trigger is not described in the available sources. Limiting factors: impact is bounded to low confidentiality and low integrity with no availability effect, and the scope is unchanged (S:U), so this does not by itself yield full site compromise. |
| Impact | This is a moderate-priority issue, not an emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, with low confidentiality and integrity impact and no availability impact - consistent with a CWE-862 Missing Authorization / broken access control weakness in a WordPress plugin. The vuln.today decision label is 'this_month', signaling a planned-remediation rather than act-now/emergency cadence. No CISA KEV listing, no EPSS score, and no proof-of-concept were provided in the input, so there is no evidence of active exploitation or published exploit code at time of analysis. Signals are internally consistent: a medium-severity access-control bug with no exploitation indicators. The main caveat is the PR:N (unauthenticated) rating versus a description that frames the flaw around 'Incorrectly Configured Access Control Security Levels' - the source does not explain the trigger mechanism, so whether exploitation truly needs no authentication, or depends on specific access-level configuration, is not confirmed by the available data and should be verified against the Patchstack advisory. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request to a WordPress site running Paid Member Subscriptions 3.1.2 or earlier and reaches a plugin action or endpoint that fails to verify the caller's authorization, allowing them to view or alter subscription/member data they should not have access to. The exact feature and request involved are not described in the available sources, and no public proof-of-concept was provided. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Remote unauthenticated attackers can bypass intended access controls in Cozmoslabs Paid Member Subscriptions through version 3.1.2, reaching plugin functionality that should be gated by membership or access-level rules. The flaw is a missing authorization weakness (CWE-862) rated CVSS 6.5, with low confidentiality and integrity impact and no availability effect; exploitation requirements beyond a reachable WordPress site running the plugin are not fully described in the available sources. No public exploit has been identified at time of analysis, and this is a moderate-priority issue rather than an emergency.
RemediationAI
Patch status is not confirmed in the supplied data-no exact fixed version is listed-so the primary remediation is to apply the vendor update once the Patchstack advisory identifies the fixed release and upgrade Paid Member Subscriptions beyond 3.1.2; the advisory is the only vendor-linked remediation source provided. No specific workaround or targeted blocking rule is documented in the available data, and because the affected endpoint and required configuration are not described, request-level filtering cannot be derived from the sources. If the plugin is not essential, disabling or removing it eliminates the exposed plugin surface, at the cost of losing membership and subscription functionality; if it is essential, monitor the advisory for the fixed release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Paid Member Subscriptions is a WordPress membership plugin by Cozmoslabs. The issue is classified CWE-862 (Missing Authorization) and described as exploiting incorrectly configured access control security levels, meaning a code path that should enforce an authorization check does not adequately do so. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, so it is remotely reachable without credentials or user interaction and is limited to low confidentiality and integrity impact with unchanged scope. The sources do not specify the affected endpoint, request pattern, or whether a particular membership/access-level configuration is required, so the precise trigger is not described in the available sources. No CPE strings were supplied in the input.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable missing-authorization flaw rated unauthenticated (PR:N) per the source vector with low confidentiality and integrity impact and no availability impact; mechanism undescribed so AC kept low.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB