CVE-2026-92536 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

WordPress Paid Membership Subscriptions plugin < 3.1.0 - Unauthenticated reCAPTCHA Bypass vulnerability

Unauthenticated reCAPTCHA Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Paid Member Subscriptions versions 3.1.0...

CVE-2026-90950

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

EUVD-2026-85195

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

CVE-2026-90950 Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

CVE-2026-90950

The Paid Membership Subscriptions WordPress plugin, in versions prior to 3.1.0 , is vulnerable to a security flaw in its registration handler . The root cause is a failure to verify the reCAPTCHA when a form field is missing from the request. This allows unauthenticated users to bypass the reCAPT...

CVE-2026-90951

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

EUVD-2026-85054

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

WordPress Paid Membership Subscriptions plugin < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion vulnerability

Unauthenticated In-Flight Checkout State Deletion vulnerability discovered by vuxvinh in WordPress Plugin Paid Member Subscriptions versions 3.1.0...

CVE-2026-90951: Incorrect Authorization

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

PT-2026-97191

Name of the Vulnerable Software and Affected Versions Paid Membership Subscriptions versions prior to 3.1.0 Description An issue exists where an unauthenticated payment action is not bound to the requesting user. This allows an attacker who possesses another member's in-flight payment identifier ...

CVE-2026-90950: Protection Mechanism Failure

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

PT-2026-97276

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

WordPress Paid Membership Subscriptions plugin < 3.0.9 - Unauthenticated Membership Payment Bypass vulnerability

Unauthenticated Membership Payment Bypass vulnerability discovered by Charles Vosburgh in WordPress Plugin Paid Member Subscriptions versions 3.0.9...

CVE-2026-90922

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

CVE-2026-90922

The Paid Membership Subscriptions WordPress plugin (versions before 3.0.9 ) contains an Improper Access Control vulnerability. The software fails to verify if the amount and currency reported by the payment provider match the pending payment details before completing the transaction. This allows ...

EUVD-2026-81349

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

CVE-2026-90922: Improper Access Control

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

WordPress User Registration & Membership plugin < 5.2.0 - Unauthenticated Paid Membership Bypass vulnerability

Unauthenticated Paid Membership Bypass vulnerability discovered by John Umoru in WordPress Plugin User Registration versions 5.2.0...

CVE-2026-14848 Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...