The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount. This vulnerability can lead to financial losses and reputational damage. Defenders should assess exposure and verify the v [truncated]
MEDIUMPaid Membership SubscriptionsCVE published 2026-07-31
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier. This vulnerability affects WordPress sites using the Paid Membership Subscriptions plugin, particula [truncated]
