# CVE-2026-107434: MicroPayments WordPress plugin subscriber bypass

Source: https://junglewise.ai/threats/cve-2026-107434-subscriber-bypass-vulnerability-in-micropayments-3-2-9-versions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107434 · Severity: medium · CVSS 5.4 · Published 2026-10-10

The MicroPayments WordPress plugin enables website owners to accept micropayments for digital goods and content. A vulnerability in versions 3.2.9 and earlier allows attackers with subscriber-level access to bypass security checks and gain unauthorized functionality. This could enable attackers to access restricted content, modify transactions, or escalate privileges beyond their intended permissions.

Vendors: [VideoWhisper](https://junglewise.ai/threats/vendors/videowhisper).

## Quick answers

**Is CVE-2026-107434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107434 being exploited in the wild.

**How severe is CVE-2026-107434?** Medium severity, with a CVSS score of 5.4, published 10 October 2026.

**Which products and versions are affected?** VideoWhisper MicroPayments 3.2.9 and earlier.

**Is there a fix for CVE-2026-107434?** Yes: fixed in 3.2.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107434 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107434?** Check whether you run VideoWhisper MicroPayments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.2.10

## Technical details

A bypass vulnerability in the MicroPayments plugin allows subscribers to circumvent security restrictions through insecure design, classified as OWASP A4. The vulnerability requires subscriber-level access to WordPress and affects versions up to 3.2.9. An attacker with subscriber credentials can bypass intended access controls to perform unauthorized actions within the payment system.

## Affected products

- VideoWhisper MicroPayments 3.2.9 and earlier

## Timeline

- 2026-10-09: disclosed
- 2026-10-09: patched: version 3.2.10 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/paid-membership/vulnerability/wordpress-micropayments-plugin-3-2-9-bypass-vulnerability-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/paid-membership/vulnerability/wordpress-micropayments-plugin-3-2-9-bypass-vulnerability-vulnerability?_s_id=cve)