CVE-2026-97249
MediumCVSS 5.3Summary
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions versions up to 3.0.9.
Risk Assessment
An unauthenticated attacker can bypass access controls, potentially gaining unauthorized access to premium features.
Recommendation
Update Paid Member Subscriptions to the latest patched version.
Other vulnerabilities in Paid Member Subscriptions
See all- CVE-2026-59539High
The Paid Member Subscriptions plugin in version 3.0.7 and earlier allows users with the Subscriber role to exploit Insecure Direct Object References (IDOR). This enables access to other users' resources without authorization.
- CVE-2026-57348High
The Paid Member Subscriptions plugin version 3.0.4 and earlier contains an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send crafted HTTP requests that are executed by the server, enabling access to internal network resources.
- CVE-2026-105317High
SQL Injection vulnerability in Paid Member Subscriptions up to version 3.1.1 allows a subscriber to inject malicious SQL code into database queries.
- CVE-2026-39514High
Versions of Paid Member Subscriptions up to 2.17.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS