Unauthorized Access Vulnerability in Paid Membership Subscriptions WordPress Plugin
CVE-2026-14848
Currently unrated
What is CVE-2026-14848?
The Paid Membership Subscriptions plugin for WordPress prior to version 3.0.8 allows authenticated users with Subscriber-level access or higher to modify another user's subscription. This vulnerability stems from the plugin's failure to verify subscription ownership during the change-subscription checkout process, enabling attackers to take over subscriptions and alter critical subscription details like plan, status, and expiration.
Affected Version(s)
Paid Membership Subscriptions 0 < 3.0.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.