CVE-2025-11835

MediumCVSS 5.3

Published: 05/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The Paid Membership Subscriptions plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability and validation check in the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to and including 2.16.4. An unauthenticated attacker can trigger stored auto-renew charges for arbitrary members.

Risk Assessment

An attacker can trigger financial charges for subscribers without authentication, potentially leading to unexpected fees and disputes. This can harm the reputation and finances of the organization and its users.

Recommendation

Update the Paid Membership Subscriptions plugin to a version later than 2.16.4. Monitor for unusual transactions and consider temporarily disabling auto-renewal functionality.

Other vulnerabilities in Paid Membership Subscriptions

CVE-2026-90950Medium
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.

Original NVD description (English source)

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to, and including, 2.16.4. This makes it possible for unauthenticated attackers to trigger stored auto-renew charges for arbitrary members.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS