Executive brief
A security vulnerability exists in the Paid Member Subscriptions plugin for WordPress, which is used to manage memberships and restrict content access. An attacker can exploit this flaw to bypass authorization checks and potentially modify data they should not have access to. This could lead to unauthorized changes in subscription details or member records, impacting the integrity of the membership system.
Technical details
The Paid Member Subscriptions plugin for WordPress (versions <= 3.0.7) contains an Insecure Direct Object Reference (IDOR) vulnerability, classified as CWE-639. The flaw allows a remote attacker to bypass authorization by manipulating identifiers in requests to the server. While the CVSS vector indicates no authentication is required (PR:N), the vulnerability is specifically noted as a 'Subscriber' IDOR, suggesting it may involve escalating the privileges of a low-level user to modify objects belonging to others. Successful exploitation allows an attacker to interact with the database or modify records without proper authorization. The issue is resolved in version 3.0.8.
Affected products
- Cozmoslabs Paid Member Subscriptions <= 3.0.7
Timeline
- 2026-07-09: disclosed: Reported by Ananda Dhakal via Patchstack
- 2026-07-23: advisory: Patchstack advisory published
- 2026-07-27: advisory: NVD published CVE-2026-59539
- 2026-07-27: patched: Version 3.0.8 released to address the vulnerability