Insecure Direct Object References in Paid Member Subscriptions Plugin by WordPress
CVE-2026-59539

7.5HIGH

Key Information:

Vendor

WordPress
Status
Paid Member Subscriptions
Vendor
CVE Published:
27 July 2026

What is CVE-2026-59539?

The Paid Member Subscriptions plugin for WordPress versions up to 3.0.7 is susceptible to Insecure Direct Object References (IDOR), which could allow malicious users to gain unauthorized access to sensitive data. This vulnerability potentially permits attackers to exploit nondisclosure of user permissions, thus accessing or modifying data belonging to other users without proper authorization. Implementing proper access controls and ensuring data integrity checks are vital steps to mitigate this risk.

Affected Version(s)

Paid Member Subscriptions <= 3.0.7

References

https://patchstack.com/database/wordpress/plugin/paid-mem...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
.