CVE-2025-11835: WordPress PMS Auth Bypass Vulnerability

CVE-2025-11835 Overview

CVE-2025-11835 affects the Paid Membership Subscriptions WordPress plugin, which provides membership, recurring payment, and content restriction functionality. The vulnerability stems from a missing capability and validation check in the PMS_AJAX_Checkout_Handler::process_payment() function. All versions up to and including 2.16.4 are affected. Unauthenticated attackers can trigger stored auto-renew charges against arbitrary members. The flaw is categorized as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated attackers can remotely trigger auto-renew charges on stored payment methods for arbitrary members, causing financial impact to site users.

Affected Products

Paid Membership Subscriptions plugin for WordPress — all versions ≤ 2.16.4
WordPress sites using the plugin's AJAX checkout handler
Sites with stored auto-renew payment methods for members

Discovery Timeline

2025-11-05 - CVE-2025-11835 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11835

Vulnerability Analysis

The vulnerability resides in the PMS_AJAX_Checkout_Handler::process_payment() function of the Paid Membership Subscriptions plugin. The function is exposed as an AJAX endpoint but does not enforce capability checks or validate the identity of the caller against the target subscription. As a result, any unauthenticated visitor can invoke the endpoint and initiate a payment operation on behalf of another member.

Because the plugin supports recurring payments with stored payment method tokens, the AJAX handler can trigger charges against previously saved billing details. Attackers do not need to know payment card data. They only need to reference the target member or subscription identifier in the request.

This class of flaw falls under Missing Authorization [CWE-862]. The impact is limited to integrity of member billing state, which aligns with the CVSS integrity-only impact profile.

Root Cause

The root cause is the absence of two required controls in process_payment(). First, no WordPress capability check confirms the caller is authorized to act on the target subscription. Second, no nonce or ownership validation ties the request to an authenticated session belonging to the member being charged. The endpoint trusts caller-supplied identifiers.

Attack Vector

An attacker sends a crafted AJAX POST request to the plugin's checkout handler over the network without authentication. The request references a target member with an active auto-renew subscription. The handler processes the payment against the stored payment method, generating an unauthorized charge. Refer to the Wordfence Vulnerability Report for advisory details.

No verified public exploit code is available. See the WordPress Plugin Changeset for the vendor fix.

Detection Methods for CVE-2025-11835

Indicators of Compromise

Unexpected admin-ajax.php POST requests referencing the plugin's checkout action from unauthenticated sessions
Auto-renew payment transactions logged for members outside their normal billing cycle
Member complaints or chargebacks tied to renewals they did not authorize
Bursts of POST requests to the checkout endpoint from a single source IP

Detection Strategies

Review web server access logs for anonymous POST requests targeting the Paid Membership Subscriptions AJAX checkout action
Correlate payment gateway transaction logs with WordPress user session activity to identify charges without a matching authenticated session
Alert on repeated calls to process_payment from clients lacking a valid WordPress authentication cookie

Monitoring Recommendations

Enable verbose logging on the WordPress AJAX endpoint and forward logs to a centralized SIEM
Monitor payment gateway webhooks for renewal charges that do not align with the plugin's expected schedule
Track anomalous traffic patterns to /wp-admin/admin-ajax.php using a web application firewall

How to Mitigate CVE-2025-11835

Immediate Actions Required

Update the Paid Membership Subscriptions plugin to a version above 2.16.4 that includes the fix from changeset 3383182
Audit recent payment gateway transactions for unauthorized auto-renew charges and issue refunds where appropriate
Rotate any exposed webhook secrets and review member billing records for anomalies

Patch Information

The vendor addressed the missing authorization in changeset 3383182 by adding the required capability and validation checks to PMS_AJAX_Checkout_Handler::process_payment(). Site administrators must upgrade to the patched release. Full advisory details are available in the Wordfence Vulnerability Report.

Workarounds

Temporarily disable the Paid Membership Subscriptions plugin until the patched version is deployed
Block unauthenticated POST requests to the plugin's checkout AJAX action at the web application firewall
Disable auto-renew billing for member accounts until the plugin has been upgraded

bash

# Example WAF rule fragment to block unauthenticated checkout AJAX calls
# Adjust action name to match the plugin's registered wp_ajax_nopriv_* hook
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1011835,msg:'Block PMS process_payment unauth'"
SecRule ARGS:action "@rx ^pms_(process_payment|checkout)$" \
  "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"