# Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.3 - Unauthenticated Payment Bypass via PayPal Connect Order Substitution

- **ID:** WPSEC-2026-2332
- **Plugin:** Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (`paid-member-subscriptions`), https://wordpress.org/plugins/paid-member-subscriptions/
- **Affected versions:** all versions before 3.1.4
- **Fixed in:** 3.1.4 (Update to 3.1.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/paid-member-subscriptions
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2332/

## Description

The Paid Membership Subscriptions plugin for WordPress is vulnerable to Payment Bypass via the PayPal Connect checkout in all versions up to, and including, 3.1.3, due to insufficient verification of data authenticity. The PayPal order ID supplied in the checkout request was attached to the pending payment and captured without checking that the order's amount and currency matched that payment. This makes it possible for unauthenticated attackers to complete checkout for a more expensive subscription plan by supplying a PayPal order created and approved for a cheaper amount, and so obtain the membership without paying its full price.

## References

- https://wpsec.com/vuln/WPSEC-2026-2332/
- https://plugins.svn.wordpress.org/paid-member-subscriptions/tags/3.1.4/
- https://wordpress.org/plugins/paid-member-subscriptions/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2332/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.