CVE-2026-59539
HighCVSS 7.5Summary
The Paid Member Subscriptions plugin in version 3.0.7 and earlier allows users with the Subscriber role to exploit Insecure Direct Object References (IDOR). This enables access to other users' resources without authorization.
Risk Assessment
Subscribers may gain unauthorized access to other members' data, compromising system integrity and confidentiality.
Recommendation
Update the Paid Member Subscriptions plugin to a version higher than 3.0.7 that fixes the IDOR vulnerability.
Other vulnerabilities in Paid Member Subscriptions
See all- CVE-2026-57348High
The Paid Member Subscriptions plugin version 3.0.4 and earlier contains an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send crafted HTTP requests that are executed by the server, enabling access to internal network resources.
- CVE-2026-39514High
Versions of Paid Member Subscriptions up to 2.17.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.