Vulnerability · Published Sep 23, 2026 · Assigned by WPScan
CVE-2026-90951Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment
Low 3.7
In plain English
A low-severity incorrect authorization in Paid Membership Subscriptions from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.2%top 84.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Paid Membership Subscriptions | 0 – before 3.1.0 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/bf740af6-3674-461e-83f0-22bd5c5b3378/ exploit, vdb-entry, technical-description