What is the CVSS score of EUVD-2026-26782?

EUVD-2026-26782 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Paid Memberships Pro are affected by EUVD-2026-26782?

Paid Memberships Pro for WordPress versions up to 3.6.5 contain a critical authorization flaw that allows low-privilege user accounts to completely disable Stripe payment processing by manipulating…

How to fix or mitigate EUVD-2026-26782?

Within 24 hours: Audit current Paid Memberships Pro installation and identify installed version; restrict user roles with Subscriber or equivalent access if applicable to your site architecture. Within 7 days: Contact Paid Memberships Pro support to obtain patched version 3.6.6 or later (once released implementing PR #3615 authorization controls); test in staging environment before production deployment. Within 30 days: Complete deployment to production; implement WordPress role-based access controls limiting administrative capabilities to Editor+ roles only; monitor Stripe webhook logs for unauthorized modification attempts.

Paid Memberships Pro EUVD-2026-26782

| CVE-2026-4100 HIGH

Missing Authorization (CWE-862)

2026-05-02 Wordfence

Authentication Bypass WordPress

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 02, 2026 - 12:31 vuln.today

Analysis Generated

May 02, 2026 - 12:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 12:00 euvd

EUVD-2026-26782

Analysis Generated

May 02, 2026 - 12:00 vuln.today

CVE Published

May 02, 2026 - 11:16 nvd

HIGH 7.1

DescriptionCVE.org

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the wp_ajax_pmpro_stripe_create_webhook, wp_ajax_pmpro_stripe_delete_webhook, and wp_ajax_pmpro_stripe_rebuild_webhook AJAX handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete, create, or rebuild the site's Stripe webhook, disrupting all payment processing, subscription renewal synchronization, cancellation handling, and failed payment management.

AnalysisAI

Authenticated attackers with Subscriber-level access can disrupt all Stripe payment processing in Paid Memberships Pro for WordPress versions up to 3.6.5 by deleting, creating, or rebuilding webhook configurations. Missing capability checks on three AJAX handlers (pmpro_stripe_create_webhook, pmpro_stripe_delete_webhook, pmpro_stripe_rebuild_webhook) allow low-privilege users to break subscription renewals, cancellation handling, and failed payment management for the entire site. Patch available in PR #3615 implementing proper authorization checks requiring manage_options or pmpro_paymentsettings capabilities plus nonce validation. EPSS data not provided; no CISA KEV listing indicates no confirmed active exploitation at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization) in WordPress AJAX handlers. The affected plugin uses Stripe webhooks to synchronize payment events between Stripe's API and WordPress, handling critical e-commerce functions like subscription lifecycle management and payment failure notifications. The three vulnerable AJAX endpoints directly manipulate Stripe webhook configuration via the Stripe API without verifying that the authenticated user holds administrative capabilities. WordPress's wp_ajax_ action hooks execute for any authenticated user by default unless developers explicitly add capability checks using current_user_can(). The fix introduces a private authorize_stripe_webhook_request() method that validates both user capabilities (manage_options or pmpro_paymentsettings) and AJAX nonce tokens before allowing webhook modifications. The CPE identifies the vulnerable component as the Paid Memberships Pro plugin (strangerstudios:paid_memberships_pro) with wildcard versioning indicating all versions through 3.6.5 are affected.

RemediationAI

Upstream fix available in GitHub pull request #3615 (https://github.com/strangerstudios/paid-memberships-pro/pull/3615); released patched version not independently confirmed from available data, though the PR targeting suggests version 3.6.6 or 3.2.6 based on @since annotation in code comments. Site administrators should upgrade to the latest version of Paid Memberships Pro immediately through the WordPress plugin update mechanism. The patch implements capability checks requiring manage_options or pmpro_paymentsettings permissions and adds nonce validation to all three vulnerable AJAX handlers. As a temporary workaround until patching, restrict WordPress user registration to prevent unauthorized Subscriber account creation, and audit existing Subscriber-level accounts for suspicious activity, though this does not protect against already-compromised low-privilege accounts. For high-security environments, consider temporarily disabling the plugin or switching to manual payment processing if immediate patching is not feasible, though this will disrupt automated subscription management. Monitor Stripe webhook configuration in the Stripe Dashboard for unexpected deletions or modifications as an incident detection measure. No evidence suggests this workaround introduces compatibility issues, but manual payment processing significantly increases administrative overhead for membership sites.