EUVD-2026-51417
GHSA-wv4h-qxh7-5899
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
AV:N and PR:N confirmed by description; AC:H retained for timing dependency; C upgraded to H given PII and payment data exposure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.
AnalysisAI
Unauthenticated download of exported member and payment PII is possible in the Paid Membership Subscriptions WordPress plugin before 3.0.7 due to export files being written to a predictable, unprotected path within the publicly accessible uploads directory. Any site running an affected version where an administrator has recently triggered an export is at risk of exposing member personally identifiable information and payment records to any network-accessible attacker. A publicly available proof-of-concept exploit exists per WPScan, and while the CVSS base score is low (3.7), the data sensitivity of the exposed artifact elevates real-world impact beyond what the score alone suggests.
Technical ContextAI
The vulnerability is classified as CWE-552 (Files or Directories Accessible to External Parties). The plugin generates member and payment export files - likely CSV or similar structured formats containing PII and payment metadata - and places them in the WordPress uploads directory at predictable, guessable paths rather than behind authenticated endpoints, private storage locations, or randomized filenames. The WordPress uploads directory is web-accessible by default unless explicitly restricted (e.g., via .htaccess deny rules), meaning any file written there without access controls is publicly reachable. The affected CPE is cpe:2.3:a:unknown:paid_membership_subscriptions:*:*:*:*:*:*:*:* covering all versions before 3.0.7.
RemediationAI
Upgrade to Paid Membership Subscriptions version 3.0.7 or later, which is the vendor-released patch confirmed by WPScan and referenced in the advisory at https://wpscan.com/vulnerability/306a498d-0740-479b-b182-71fc3d7452bb/. Until patching is possible, as a compensating control add an .htaccess deny rule scoped to the specific export subdirectory within wp-content/uploads to block direct HTTP access - note this requires identifying the exact directory the plugin uses and may need to be re-evaluated if the plugin changes paths. Alternatively, configure the web server to return 403 for requests matching the known export filename pattern. Defenders should also audit existing uploads directories for leftover export artifacts and delete them immediately, since previously triggered exports may have already left discoverable files. Do not rely on obscurity of the filename alone as sufficient mitigation given that a public exploit exists.
Horizontal privilege escalation in the Paid Membership Subscriptions WordPress plugin (all versions before 3.0.8) allows
Insecure Direct Object Reference in the Paid Membership Subscriptions WordPress plugin (before 3.0.7) allows any authent
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.10.4. Rated medium severity (CVS
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today