Quick answers
- Is CVE-2026-59539 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59539 being exploited in the wild.
- How severe is CVE-2026-59539?
- High severity, with a CVSS score of 7.5, published 27 July 2026.
- Which products and versions are affected?
- Cozmoslabs Paid Member Subscriptions <= 3.0.7.
- Is there a fix for CVE-2026-59539?
- A patch was published on 2026-07-27: Version 3.0.8 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59539 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-59539?
- Check whether you run Cozmoslabs Paid Member Subscriptions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Paid Member Subscriptions plugin for WordPress (versions <= 3.0.7) contains an Insecure Direct Object Reference (IDOR) vulnerability, classified as CWE-639. The flaw allows a remote attacker to bypass authorization by manipulating identifiers in requests to the server. While the CVSS vector indicates no authentication is required (PR:N), the vulnerability is specifically noted as a 'Subscriber' IDOR, suggesting it may involve escalating the privileges of a low-level user to modify objects belonging to others. Successful exploitation allows an attacker to interact with the database or modify records without proper authorization. The issue is resolved in version 3.0.8.
Affected products
- Cozmoslabs Paid Member Subscriptions <= 3.0.7
Timeline
- 2026-07-09: disclosed: Reported by Ananda Dhakal via Patchstack
- 2026-07-23: advisory: Patchstack advisory published
- 2026-07-27: advisory: NVD published CVE-2026-59539
- 2026-07-27: patched: Version 3.0.8 released to address the vulnerability