Paid Member Subscriptions CVE-2026-97249

Requires only that a target WordPress site run Paid Member Subscriptions plugin version 3.0.9 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, unauthenticated, low-complexity, and needs no user interaction against a default installation. The limiting factors are impact scope rather than access: the flaw yields only a LOW integrity effect with no confidentiality or availability impact (C:N/A:N), so the realistic outcome is bypassing a specific membership/access-control gate rather than full compromise. The exact feature or protected resource affected is not specified in the available advisory data.

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N describes a remotely reachable, low-complexity flaw requiring no authentication or user interaction, but whose only impact is a LOW integrity effect (C:N/A:N). CWE-290 (Authentication Bypass by Spoofing) combined with the 'Unauthenticated Bypass' title indicates an attacker can circumvent an access/authentication control to reach or alter something they should not, though the constrained I:L and null confidentiality/availability suggest a scoped bypass (e.g., bypassing a specific membership/paywall gate or protected content restriction) rather than a full account takeover or admin compromise. There is no EPSS score, no CISA KEV listing, and no public exploit provided in the input, so this is not confirmed as actively exploited; no SSVC decision data is supplied. Net assessment: a legitimate unauthenticated remote weakness worth patching, but the low technical impact and absence of exploitation signals place it below high-CVSS/high-urgency issues. The single Patchstack reference provides no affected-parameter, endpoint, or sink detail, so the exact bypass mechanism cannot be verified from available data.

An unauthenticated remote attacker sends a crafted HTTP request to a WordPress site running Paid Member Subscriptions <= 3.0.9, spoofing or omitting a value that the plugin trusts for access decisions, thereby bypassing a membership/access-control check to reach or manipulate protected functionality. Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials, victim interaction, or special timing are needed. No public proof-of-concept was identified in the provided intelligence.