{
 "id": "WPSEC-2026-2332",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2332/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2332/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2332/index.md",
 "title": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.3 - Unauthenticated Payment Bypass via PayPal Connect Order Substitution",
 "description": "The Paid Membership Subscriptions plugin for WordPress is vulnerable to Payment Bypass via the PayPal Connect checkout in all versions up to, and including, 3.1.3, due to insufficient verification of data authenticity. The PayPal order ID supplied in the checkout request was attached to the pending payment and captured without checking that the order's amount and currency matched that payment. This makes it possible for unauthenticated attackers to complete checkout for a more expensive subscription plan by supplying a PayPal order created and approved for a cheaper amount, and so obtain the membership without paying its full price.",
 "plugin": {
  "slug": "paid-member-subscriptions",
  "name": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction",
  "full_name": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction",
  "wordpress_org": "https://wordpress.org/plugins/paid-member-subscriptions/",
  "advisories_url": "https://wpsec.com/vuln/plugin/paid-member-subscriptions/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/paid-member-subscriptions"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.4",
 "remediation": "Update to 3.1.4 or later.",
 "fix_released": "2026-11-02T09:58:52+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:19.894344+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2332/",
  "https://plugins.svn.wordpress.org/paid-member-subscriptions/tags/3.1.4/",
  "https://wordpress.org/plugins/paid-member-subscriptions/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/paid-member-subscriptions",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}