Insecure Direct Object Reference in Paid Membership Plugin for WordPress
CVE-2026-10820
Currently unrated
What is CVE-2026-10820?
The Paid Membership Plugin for WordPress prior to version 4.16.17 is affected by an Insecure Direct Object Reference vulnerability. This flaw allows any authenticated user with Subscriber role or higher to cancel active subscriptions of other users without verifying ownership of the subscription. This vulnerability could lead to unauthorized cancellation of subscriptions, posing a risk to user accounts and their associated benefits.
Affected Version(s)
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content 0 < 4.16.17
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.