Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.0 - Unauthenticated Missing Authorization to Payment and Subscription Processing via Stripe Return URL
- ID
- WPSEC-2026-0282
- Plugin
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (paid-member-subscriptions)
- Affected
- from 2.9.3 before 3.1.1
- Remediation
- Update to 3.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction on WPSec AttackSurface
- Fix released
- Published
Description
The Paid Membership Subscriptions plugin for WordPress is vulnerable to unauthorized payment processing via the Stripe return URL handler in versions 2.9.3 up to, and including, 3.1.0 due to insufficient verification of data authenticity: the handler accepted a Stripe payment or setup intent ID from the URL and processed the matching payment without checking that the visitor held the intent's client secret. This makes it possible for unauthenticated attackers who know another member's intent ID to mark that member's pending payment as failed while it still awaits bank or card authentication, add log entries to it, and overwrite the email address, name and billing address on that member's Stripe customer record with the details of another site user.
References
- https://wpsec.com/vuln/WPSEC-2026-0282/
- https://plugins.svn.wordpress.org/paid-member-subscriptions/tags/3.1.1/
- https://wordpress.org/plugins/paid-member-subscriptions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS