EUVD-2026-51416
GHSA-9922-j5r7-r6hp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network AJAX endpoint requires only a subscriber session (PR:L); no attack complexity; read-only payment enumeration yields limited confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.
AnalysisAI
Insecure Direct Object Reference in the Paid Membership Subscriptions WordPress plugin (before 3.0.7) allows any authenticated subscriber-level user to enumerate and retrieve payment records belonging to other members. The AJAX handler responsible for payment data retrieval performs neither a WordPress capability check nor a nonce validation, meaning horizontal privilege escalation requires only a valid low-privilege account on the target site. A publicly available proof-of-concept exists per WPScan, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
Technical ContextAI
The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of IDOR flaws where an application uses a user-controlled identifier - here, a sequential or otherwise guessable payment ID - to retrieve records without verifying that the requesting user is the owner of that record. In WordPress, AJAX handlers are registered via wp_ajax_ or wp_ajax_nopriv_ hooks; the affected handler omits both current_user_can() capability enforcement and wp_verify_nonce() CSRF protection. This dual omission means any authenticated session can call the endpoint and freely cycle through payment identifiers. The CPE string (cpe:2.3:a:unknown:paid_membership_subscriptions:*:*:*:*:*:*:*:*) covers all versions prior to 3.0.7, confirmed by EUVD-2026-51416 and the WPScan advisory.
RemediationAI
Upgrade the Paid Membership Subscriptions plugin to version 3.0.7 or later, which introduces proper capability and nonce checks on the affected AJAX payment endpoint. The vendor-released patch is documented in the WPScan advisory at https://wpscan.com/vulnerability/5cd6d414-8d7d-4627-9649-af092a1afb75/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-14847. If immediate patching is not possible, a compensating control is to disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register'), which removes the easiest path for unauthenticated actors to obtain a Subscriber account; note this trade-off affects legitimate new member onboarding. Additionally, a WAF rule blocking requests to the specific vulnerable AJAX action parameter can reduce exposure, though the exact action name must be sourced from the plugin's changelog or the WPScan report.
Horizontal privilege escalation in the Paid Membership Subscriptions WordPress plugin (all versions before 3.0.8) allows
Unauthenticated download of exported member and payment PII is possible in the Paid Membership Subscriptions WordPress p
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.10.4. Rated medium severity (CVS
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today