CVE-2026-14848

5.4 Moyenne

Publiée le 04/08/2026 à 09:16 · Modifiée le 26/08/2026 à 18:31 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.

Traduire en français

Produits concernés

Unknown Paid Membership Subscriptions

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-284

Références

https://wpscan.com/vulnerability/da2ae315-a534-4ae2-a8e8-61121613437b/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories