EUVD-2026-52586
GHSA-8hc5-48cx-v7wp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-accessible checkout endpoint (AV:N), subscriber account required (PR:L), no complexity barrier, modifies subscription integrity and availability but discloses no data (C:N/I:L/A:L).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.
AnalysisAI
Horizontal privilege escalation in the Paid Membership Subscriptions WordPress plugin (all versions before 3.0.8) allows any subscriber-level authenticated user to hijack and overwrite another member's subscription - including plan tier, status, and expiration date - by submitting a crafted change-subscription checkout request with an arbitrary subscription ID. The root cause is a missing ownership verification check at the business logic layer of the checkout flow (CWE-284). A publicly available proof-of-concept exploit has been published by WPScan, though EPSS sits at just 0.13% (3rd percentile), suggesting limited automated exploitation so far. The vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
CWE-284 (Improper Access Control) describes failures where software does not restrict access to resources correctly. In this case, the plugin's change-subscription checkout handler accepts a subscription identifier as a request parameter but does not validate that the identifier belongs to the session's authenticated user - a classic Insecure Direct Object Reference (IDOR) pattern. The affected product is identified in NVD CPE as cpe:2.3:a:unknown:paid_membership_subscriptions:*:*:*:*:*:*:*:* (vendor field unresolved). Because WordPress subscription IDs are typically sequential integers, enumeration is trivial. The flaw exists in the checkout flow specifically triggered when a subscriber initiates a plan change, meaning the vulnerable code path is part of normal plugin functionality rather than an obscure admin feature.
RemediationAI
The vendor-released patch is Paid Membership Subscriptions version 3.0.8, which introduces subscription ownership verification during the change-subscription checkout flow. Site administrators should update the plugin to 3.0.8 or later immediately via the WordPress dashboard or by downloading directly from the plugin repository. The WPScan advisory at https://wpscan.com/vulnerability/da2ae315-a534-4ae2-a8e8-61121613437b/ should be consulted for confirmation. If patching cannot be performed immediately, a compensating control is to disable the plan-change / subscription upgrade checkout feature through plugin settings, preventing the vulnerable code path from being triggered entirely - note this removes subscriber self-service plan upgrades as a trade-off. Additionally, restricting new subscriber registrations temporarily reduces the attacker pool if open registration is enabled.
Insecure Direct Object Reference in the Paid Membership Subscriptions WordPress plugin (before 3.0.7) allows any authent
Unauthenticated download of exported member and payment PII is possible in the Paid Membership Subscriptions WordPress p
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.10.4. Rated medium severity (CVS
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today