Veille CVE

Recherche « Unknown Paid Membership Subscriptions »

7 CVE

Critique 0 Élevée 1 Moyenne 4 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Paid Membership Subscriptions » ✕
  1. CVE-2026-90950 5.3 Moyenne

    Unknown Paid Membership Subscriptions

    The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.

  2. CVE-2026-90951 3.7 Faible

    Unknown Paid Membership Subscriptions

    The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.

  3. CVE-2026-90922 5.3 Moyenne

    Unknown Paid Membership Subscriptions

    The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.

  4. CVE-2026-14848 5.4 Moyenne

    Unknown Paid Membership Subscriptions

    The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.

  5. CVE-2026-14849 3.7 Faible

    Unknown Paid Membership Subscriptions

    The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.

  6. CVE-2026-14847 4.3 Moyenne

    Unknown Paid Membership Subscriptions

    The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.

  7. CVE-2026-10820 8.1 Élevée

    Unknown Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content

    The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.