CVE-2026-4100 Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption

🗓️ 02 May 2026 11:16:09Reported by WordfenceType

vulnrichment

vulnrichment🔗 github.com👁 4 Views

Authenticated subscribers can delete or modify Stripe webhook via AJAX due to missing checks, disrupting payments.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-4100	2 May 202611:16	–	attackerkb
Circl	CVE-2026-4100	16 May 202611:02	–	circl
CNNVD	WordPress plugin Paid Memberships Pro 安全漏洞	2 May 202600:00	–	cnnvd
CVE	CVE-2026-4100	2 May 202611:16	–	cve
Cvelist	CVE-2026-4100 Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption	2 May 202611:16	–	cvelist
EUVD	EUVD-2026-26782	2 May 202611:16	–	euvd
NVD	CVE-2026-4100	2 May 202612:16	–	nvd
OSV	CVE-2026-4100 Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption	2 May 202611:16	–	osv
Patchstack	WordPress Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption vulnerability	5 May 202616:22	–	patchstack
Positive Technologies	PT-2026-36609	2 May 202600:00	–	ptsecurity

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5b333a3d-e416-42aa-9722-5406df0a64b3
github	www.github.com/strangerstudios/paid-memberships-pro/pull/3615

02 May 2026 11:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.1

EPSS0.00247

SSVC

Paid Memberships Pro WordPress plugin Stripe webhook AJAX handlers Subscriber access Payment processing disruption