CVE-2026-14847: Cozmoslabs Paid Member Subscriptions IDOR in payment refund modal

CVE-2026-14847 · Severity: info · CVSS 4.3 · Published 2026-07-31

A vulnerability in the Paid Member Subscriptions plugin for WordPress allows any logged-in user, even those with basic subscriber access, to view private payment information belonging to other members. By guessing payment identification numbers, an attacker can access details such as payment dates, amounts, and the payment gateways used. This could lead to a breach of customer privacy and the exposure of sensitive financial transaction history.

Technologies: Cozmoslabs Paid Member Subscriptions. Vendors: Cozmoslabs.

Quick answers

Is CVE-2026-14847 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-14847 being exploited in the wild.
How severe is CVE-2026-14847?
Informational severity, with a CVSS score of 4.3, published 31 July 2026.
Which products and versions are affected?
Cozmoslabs Paid Member Subscriptions < 3.0.7.
Is there a fix for CVE-2026-14847?
A patch was published on 2026-07-31: Fixed in version 3.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14847 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-14847?
Check whether you run Cozmoslabs Paid Member Subscriptions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the 'render_modal_payment_refund' AJAX action, which fails to implement proper capability checks or nonce verification. An authenticated attacker with Subscriber-level privileges can send a POST request to admin-ajax.php with a manipulated 'pms_payment_id' parameter. Because the plugin does not verify if the requesting user has the authority to view the specific payment record, the server returns the refund modal HTML containing sensitive data including Payment ID, Date, Amount, Currency, and Gateway. This allows for full enumeration of the payment database via IDOR. The issue is fixed in version 3.0.7.

Affected products

  • Cozmoslabs Paid Member Subscriptions < 3.0.7

Timeline

  • 2026-07-13: disclosed: Publicly published by WPScan
  • 2026-07-31: advisory: NVD published date
  • 2026-07-31: patched: Fixed in version 3.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.