Paid Memberships Pro CVE-2026-4100

Upstream fix available in GitHub pull request #3615 (https://github.com/strangerstudios/paid-memberships-pro/pull/3615); released patched version not independently confirmed from available data, though the PR targeting suggests version 3.6.6 or 3.2.6 based on @since annotation in code comments. Site administrators should upgrade to the latest version of Paid Memberships Pro immediately through the WordPress plugin update mechanism. The patch implements capability checks requiring manage_options or pmpro_paymentsettings permissions and adds nonce validation to all three vulnerable AJAX handlers. As a temporary workaround until patching, restrict WordPress user registration to prevent unauthorized Subscriber account creation, and audit existing Subscriber-level accounts for suspicious activity, though this does not protect against already-compromised low-privilege accounts. For high-security environments, consider temporarily disabling the plugin or switching to manual payment processing if immediate patching is not feasible, though this will disrupt automated subscription management. Monitor Stripe webhook configuration in the Stripe Dashboard for unexpected deletions or modifications as an incident detection measure. No evidence suggests this workaround introduces compatibility issues, but manual payment processing significantly increases administrative overhead for membership sites.