Executive brief
Paid Membership Subscriptions is a WordPress plugin that manages user registration and paid membership subscriptions. The plugin fails to verify reCAPTCHA during account registration when certain form fields are missing from the request, allowing attackers to bypass the security check and create accounts without solving the CAPTCHA, which protects against automated account creation and spam.
Technical details
The vulnerability is an authentication bypass in the registration handler where the plugin does not validate reCAPTCHA if a specific form field is absent from the HTTP request. This is a logic flaw in the registration flow affecting unauthenticated users. An attacker can bypass reCAPTCHA verification by omitting the expected field, gaining the ability to create arbitrary user accounts programmatically without completing the intended security check.
Affected products
- Paid Member Subscriptions Contributors Paid Member Subscriptions before 3.1.0
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fixed in version 3.1.0