Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.3 - Unauthenticated Payment Bypass via Stripe Connect Webhook
- ID
- WPSEC-2026-2331
- Plugin
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (paid-member-subscriptions)
- Affected
- all versions before 3.1.4
- Remediation
- Update to 3.1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction on WPSec AttackSurface
- Fix released
- Published
Description
The Paid Membership Subscriptions plugin for WordPress is vulnerable to Payment Bypass via the Stripe Connect webhook handler in all versions up to, and including, 3.1.3, due to insufficient verification of data authenticity. The handler only checked a webhook signature when a signing secret was configured and a Stripe-Signature header was present. Otherwise it fell back to a legacy path. That path only checked with Stripe that the posted event ID existed, then processed the event data from the request body instead of the copy fetched from Stripe. This makes it possible for unauthenticated attackers who know a valid Stripe event ID to submit forged event data, such as payment IDs, statuses and metadata, to mark payments as completed or alter member subscriptions.
References
- https://wpsec.com/vuln/WPSEC-2026-2331/
- https://plugins.svn.wordpress.org/paid-member-subscriptions/tags/3.1.4/
- https://wordpress.org/plugins/paid-member-subscriptions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS