Paid Membership Subscriptions CVE-2026-90922

The target site must be running Paid Membership Subscriptions before version 3.0.9 AND actively selling one or more paid membership levels with an online payment provider configured. Exploitation requires the attacker to drive the public membership checkout/payment-completion flow and control the amount and/or currency value that the plugin trusts on completion; no login is required (PR:N) and no victim user interaction is needed (UI:N). The practical limiter is not authentication but the payoff scope: the attacker only gains a discounted paid membership for their own account, with no confidentiality or availability impact - so realistic risk is confined to sites where membership revenue matters. Not exploitable on sites with no paid tiers or already updated to 3.0.9.

This is a genuine but moderate business-logic/fraud risk rather than a system-compromise threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium) is internally consistent with the description: a remote, unauthenticated actor can complete the public checkout flow with a manipulated (lower) amount because the plugin never reconciles the payment-provider-reported amount and currency against the pending payment record. Impact is integrity-only (I:L) - the attacker obtains a paid membership at reduced/near-zero cost - with no confidentiality or availability effect, so the 5.3 rating is well-justified and I concur with it. Escalating signals: a public POC exists (WPScan a7f3882a) and a patch is available (3.0.9), which raises real-world likelihood versus a theoretical flaw. Tempering signals: there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or automated mass exploitation, and the payoff (discounted membership) is narrow economic fraud rather than site takeover. Note the CWE assignment (CWE-284 Improper Access Control) and the 'Authentication Bypass' tag both overstate/mislabel the mechanism - this is insufficient server-side payment/price validation, not an authentication or access-control bypass. Net: prioritize patching for any site actually selling memberships (direct revenue loss), but this is not an emergency-tier remote-code-execution class issue.

An attacker begins a normal membership purchase for a paid tier, then tampers with the amount and/or currency sent through the payment flow (e.g., via a manipulated provider callback/return or client-controlled value) so the plugin marks the pending payment complete despite an arbitrarily lower or mismatched amount. Because the plugin never verifies the reported amount and currency against the pending order, the attacker is granted the full paid membership for a fraction of the price. A public proof-of-concept for this flow is available via WPScan.