Paid Membership Subscriptions CVE-2026-90951

Exploitation requires the attacker to possess a specific victim's in-flight (active, per-checkout) payment identifier, which is only valid during that member's live payment/checkout flow - the flaw is that the vulnerable payment action does not bind the request to the requesting user, so any holder of that identifier can act on it. Limiting factors: the identifier is transient and not enumerable, requiring the attacker to obtain it out-of-band (AC:H), which is why the score is low despite unauthenticated network access; the action is affected only in Paid Membership Subscriptions versions before 3.1.0, and impact is confined to deleting the victim's checkout state (no data disclosure, no site-wide availability loss).

This is a low-priority, low-real-risk issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) is internally consistent with the description: exploitation is unauthenticated (PR:N) and remote (AV:N), but carries high attack complexity (AC:H) because the attacker must first obtain a specific victim's in-flight (transient, per-checkout) payment identifier - a value that is short-lived and not enumerable by design. Impact is limited to low integrity (I:L): the attacker can delete another member's checkout state, with no confidentiality (C:N) or availability (A:N) impact to the system itself, though it does disrupt the victim's individual checkout. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is referenced. This is a genuinely minor authorization (IDOR) flaw, not a high-CVSS-but-hyped issue - its low score already reflects real risk accurately. Conflicting signal to note: the input Tags label this 'Authentication Bypass', but CWE-863 and the description describe broken authorization (missing per-user binding / IDOR), not an authentication bypass - verify tag classification.

An attacker who observes or intercepts another member's in-flight payment identifier (e.g., via a shared/leaked checkout URL or session artifact during an active transaction) sends an unauthenticated request to the vulnerable payment action referencing that identifier, causing the plugin to delete the victim's checkout state and disrupt their subscription purchase. No public exploit code is identified at time of analysis, and high attack complexity (AC:H) means the attacker must acquire the transient identifier during the victim's active checkout window.