Authentication Bypass Vulnerability in Paid Membership Subscriptions Plugin by WordPress
CVE-2026-14847
What is CVE-2026-14847?
The Paid Membership Subscriptions plugin for WordPress before version 3.0.7 contains a vulnerability that allows authenticated users with Subscriber-level access and above to exploit a lack of capability and nonce checks on specific payment-related AJAX actions. This oversight enables these users to enumerate payment identifiers, potentially disclosing sensitive payment details of any member. Website administrators using outdated versions of this plugin are advised to update promptly to safeguard against unauthorized access to payment information.
Affected Version(s)
Paid Membership Subscriptions 0 < 3.0.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.