Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.3 - Unauthenticated Payment Bypass via PayPal Connect Order Substitution
- ID
- WPSEC-2026-2332
- Plugin
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (paid-member-subscriptions)
- Affected
- all versions before 3.1.4
- Remediation
- Update to 3.1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction on WPSec AttackSurface
- Fix released
- Published
Description
The Paid Membership Subscriptions plugin for WordPress is vulnerable to Payment Bypass via the PayPal Connect checkout in all versions up to, and including, 3.1.3, due to insufficient verification of data authenticity. The PayPal order ID supplied in the checkout request was attached to the pending payment and captured without checking that the order's amount and currency matched that payment. This makes it possible for unauthenticated attackers to complete checkout for a more expensive subscription plan by supplying a PayPal order created and approved for a cheaper amount, and so obtain the membership without paying its full price.
References
- https://wpsec.com/vuln/WPSEC-2026-2332/
- https://plugins.svn.wordpress.org/paid-member-subscriptions/tags/3.1.4/
- https://wordpress.org/plugins/paid-member-subscriptions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS