Executive brief
A vulnerability in the Paid Member Subscriptions plugin for WordPress allows any logged-in user, even those with basic subscriber access, to view private payment information belonging to other members. By guessing payment identification numbers, an attacker can access details such as payment dates, amounts, and the payment gateways used. This could lead to a breach of customer privacy and the exposure of sensitive financial transaction history.
Technical details
The vulnerability exists in the 'render_modal_payment_refund' AJAX action, which fails to implement proper capability checks or nonce verification. An authenticated attacker with Subscriber-level privileges can send a POST request to admin-ajax.php with a manipulated 'pms_payment_id' parameter. Because the plugin does not verify if the requesting user has the authority to view the specific payment record, the server returns the refund modal HTML containing sensitive data including Payment ID, Date, Amount, Currency, and Gateway. This allows for full enumeration of the payment database via IDOR. The issue is fixed in version 3.0.7.
Affected products
- Cozmoslabs Paid Member Subscriptions < 3.0.7
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD published date
- 2026-07-31: patched: Fixed in version 3.0.7