CVE-2026-97249

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions = 3.0.9 versions...

CVE-2026-97249

The Paid Member Subscriptions WordPress plugin versions

CVE-2026-97249 WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions = 3.0.9 versions...

EUVD-2026-89913

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions = 3.0.9 versions...

CVE-2026-97249 WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions = 3.0.9 versions...

CVE-2026-97249: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions = 3.0.9 versions...

WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by MYUNGYONG LEE in WordPress Plugin Paid Member Subscriptions versions = 3.0.9...

CVE-2026-90950 Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

CVE-2026-90951 Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

CVE-2026-90951 Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

CVE-2026-90951

The Paid Membership Subscriptions WordPress plugin (versions before 3.1.0 ) contains an incorrect authorization vulnerability. The root cause is that the plugin fails to bind an unauthenticated payment action to the requesting user. Specifically, an attacker who obtains another member's in-flight...

CVE-2026-90922 Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

CVE-2026-90922 Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

WordPress Paid Membership Subscriptions plugin < 3.0.7 - Subscriber+ Payment Data Disclosure vulnerability

Subscriber+ Payment Data Disclosure vulnerability discovered by WEI HSIANG WANG in WordPress Plugin Paid Member Subscriptions versions 3.0.7...

WordPress Paid Membership Subscriptions plugin < 3.0.7 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Paid Member Subscriptions versions 3.0.7...

CVE-2026-59539

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

CVE-2026-59539

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

CVE-2026-59539

CVE-2026-59539 affects the WordPress plugin Paid Member Subscriptions (versions

CVE-2026-59539 WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

CVE-2026-59539 WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...