Paid Member Subscriptions CVE-2026-39514

Exploitation requires (1) a WordPress site running the Paid Member Subscriptions plugin at version 2.17.3 or earlier with the vulnerable endpoint reachable from the public internet, and (2) a victim - typically an authenticated administrator or privileged user - clicking an attacker-supplied crafted URL (UI:R). No authentication is required of the attacker (PR:N), and no special non-default plugin configuration is implied by the description beyond having the plugin installed and active. Limiting factors: the attack is reflected (not stored), so each victim must individually click a unique attacker-controlled link, and impact is bounded to the victim's browser session unless chained to admin-context actions.

Signals are mixed but lean toward moderate risk. CVSS 3.1 is 7.1 (High) with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - network-reachable, low complexity, no privileges, but requiring user interaction (clicking a crafted link), with limited C/I/A impacts that cross a scope boundary. There is no CISA KEV listing and no public POC referenced in the input, and EPSS data is not provided, so probability of opportunistic mass exploitation cannot be quantified. The realistic threat is targeted phishing of WordPress administrators: a successful click by an authenticated admin can lead to session theft or admin-context actions, which is why reflected XSS in popular WP plugins is routinely abused even without a published exploit. The CVSS user-interaction requirement (UI:R) materially limits drive-by exploitation, so this is a meaningful patching priority for sites running the plugin but not an emergency on the level of pre-auth RCE.

An attacker crafts a URL pointing at a vulnerable Paid Member Subscriptions endpoint on a target WordPress site, embedding JavaScript in a reflected parameter, and delivers it via phishing email or a malicious link on another site. When a logged-in WordPress administrator clicks the link, the injected script runs in their browser under the site's origin and can steal session cookies, perform admin actions via the REST API, or create a new admin user. No public exploit code is referenced in the available data, but reflected-XSS payloads for WordPress plugins are trivial to construct once the vulnerable parameter is known.