Executive brief
The Paid Member Subscriptions plugin for WordPress, which manages memberships and payments, fails to secure temporary export files. This allows unauthorized individuals to download sensitive member data, including names, email addresses, and transaction details, if an administrator has recently generated an export report. Such exposure could lead to privacy violations and the theft of personally identifiable information (PII).
Technical details
The vulnerability is classified as an unauthenticated sensitive information exposure (CWE-552) due to insecure file storage. When an administrator initiates a member or payment export, the plugin generates CSV files (e.g., pms-members.csv or pms-payments.csv) in the public-facing /wp-content/uploads/ directory. Because these filenames are predictable and the directory lacks proper access controls, an attacker can directly request the files via a web browser or automated tool. The data remains exposed if the export process is interrupted or until the file is manually deleted or overwritten. The issue is resolved in version 3.0.7.
Affected products
- Cozmoslabs Paid Member Subscriptions < 3.0.7
Timeline
- 2026-07-13: disclosed
- 2026-07-31: advisory: NVD publication date