Paid Membership Subscriptions EUVD-2026-85195

Exploitable only when the site runs Paid Membership Subscriptions before version 3.1.0 AND has the reCAPTCHA feature enabled on its registration form. The core prerequisite is that the registration handler fails to verify reCAPTCHA when the reCAPTCHA form field is absent from the request, so the attacker simply omits that field. No authentication and no user interaction are required (AV:N/PR:N/UI:N), but the limiting factor is configuration-specific: sites without reCAPTCHA enabled gain nothing to bypass, and the only outcome is unsolved-CAPTCHA account registration, not data access or code execution.

This is a low-severity protection-mechanism-bypass, not a high-impact flaw. The CVSS 3.1 base of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects remote, unauthenticated, low-complexity access with no user interaction, but the real-world impact is narrow: an attacker can register accounts without solving the site's reCAPTCHA by omitting the expected form field. Exploitation status is 'publicly available exploit code exists' - WPScan (the reporter) publishes a vulnerability entry flagged as an exploit - but this is NOT active exploitation: no CISA KEV listing and no EPSS score were provided, so widespread or targeted in-the-wild use is unconfirmed. Note a signal conflict: the vendor vector claims C:L (confidentiality), yet the description describes a reCAPTCHA/anti-automation bypass enabling unauthorized account creation, which is functionally an integrity/abuse issue with no data disclosure - the C:L attribution is questionable and the 'Information Disclosure' tag is inaccurate. Net: a real but low-priority hardening bug (spam/bot-registration exposure), not an urgent RCE-class threat.

An attacker sends automated registration requests to a Paid Membership Subscriptions form (v < 3.1.0) that has reCAPTCHA enabled, deliberately omitting the reCAPTCHA form field so the handler skips verification entirely. This lets bots mass-create member accounts without solving any challenge; a public WPScan exploit entry documents the technique.