What is the CVSS score of EUVD-2026-39664?

EUVD-2026-39664 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Paid Memberships Pro - Add Member From Admin are affected by EUVD-2026-39664?

A CSRF vulnerability in WordPress plugin Paid Memberships Pro - Add Member From Admin (v0.7.2 and earlier) exposes organizations to unauthorized membership account creation and modification when…

How to fix or mitigate EUVD-2026-39664?

24 hours: Audit membership records for unauthorized account modifications and deactivate the plugin if non-critical. 7 days: Enable detailed logging for all member-add and member-modify actions, restrict admin dashboard access to trusted IP ranges, and contact Paid Memberships Pro vendor for patch timeline. 30 days: Evaluate alternative member-management plugins and establish weekly membership audit reviews pending patch availability.

Paid Memberships Pro - Add Member From Admin EUVD-2026-39664

| CVE-2026-57659 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-26 audit@patchstack.com

GHSA-2c8x-qv4p-jqcj

WordPress CSRF Wordpress Plugin

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network CSRF with no attacker privileges but requiring a logged-in admin to interact (UI:R); forged admin action yields high impact to member data integrity, confidentiality, and availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:46 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.

AnalysisAI

Cross-Site Request Forgery in the WordPress plugin 'Paid Memberships Pro - Add Member From Admin' (versions 0.7.2 and earlier) lets a remote attacker forge privileged member-management actions by tricking a logged-in administrator into loading a malicious page. Because the plugin's member-add functionality lacks valid CSRF nonce protection (CWE-352), an attacker can abuse the admin's authenticated session to create or modify membership records, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not supplied.

Technical ContextAI

The affected component is an add-on extending the popular Paid Memberships Pro membership/subscription framework for WordPress, specifically the administrative 'Add Member From Admin' workflow that provisions member accounts and membership levels. The root cause is CWE-352 (Cross-Site Request Forgery): the plugin processes state-changing admin requests without verifying a unique, unpredictable anti-CSRF token (WordPress nonce) tied to the user session. As a result, the server cannot distinguish a legitimate admin-initiated form submission from a request forged by an attacker-controlled page that rides on the admin's existing authenticated cookies. No CPE strings were provided in the input, so exact affected configurations are derived from the plugin name and the stated version ceiling (<= 0.7.2).

RemediationAI

Patch status: no exact fixed version was provided in the input, and the only reference is a Patchstack advisory rather than a tagged release, so treat the fix as not independently confirmed and update to the latest available release of 'Paid Memberships Pro - Add Member From Admin' above 0.7.2 once published - consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/pmpro-add-member-admin/vulnerability/wordpress-paid-memberships-pro-add-member-from-admin-plugin-0-7-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) and the plugin's WordPress.org page for the patched version. As compensating controls until a confirmed patch is applied: deactivate the 'Add Member From Admin' add-on if member provisioning can be done through core PMPro (trade-off: loss of the bulk/admin add-member convenience); deploy a WAF or Patchstack virtual patch rule to enforce referer/origin checks on the plugin's admin-ajax/admin-post endpoints (trade-off: possible false positives on legitimate admin actions); and instruct administrators to log out of wp-admin when not in use and avoid browsing untrusted sites in the same session (trade-off: operational friction, partial mitigation only since it relies on user behavior).