CVE-2026-14847: Paid Membership Subscriptions Plugin Flaw

CVE-2026-14847 Overview

CVE-2026-14847 affects the Paid Membership Subscriptions WordPress plugin in versions prior to 3.0.7. The plugin fails to perform capability or nonce checks on one of its payment-related AJAX actions. Any authenticated user with Subscriber-level access or higher can enumerate payment identifiers to disclose payment details belonging to other members. The flaw maps to CWE-639, Authorization Bypass Through User-Controlled Key, commonly referred to as Insecure Direct Object Reference (IDOR).

Critical Impact
Low-privileged authenticated attackers can read arbitrary member payment records by iterating payment IDs, resulting in disclosure of sensitive financial data.

Affected Products

Paid Membership Subscriptions WordPress plugin versions before 3.0.7
WordPress sites using the plugin for paid member management
WordPress sites permitting Subscriber-level or higher self-registration

Discovery Timeline

2026-07-31 - CVE-2026-14847 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-14847

Vulnerability Analysis

The vulnerability resides in one of the plugin's payment-related AJAX handlers. The handler processes requests without validating user capability and without verifying a WordPress nonce. Any session with an authenticated Subscriber role satisfies the authentication check performed by admin-ajax.php, which the plugin does not extend with authorization or CSRF protections. An attacker submits a payment identifier as a request parameter, and the handler returns the associated payment record regardless of ownership. Exploitation requires only a valid WordPress account, which many membership sites grant by default upon self-registration. The disclosed data can include amounts, transaction identifiers, gateway metadata, and other personally identifiable billing information tied to other members.

Root Cause

The root cause is missing authorization enforcement on a server-side AJAX action. The plugin trusts the client-supplied payment identifier and does not verify that the requesting user owns the referenced payment. The absence of a nonce check compounds the issue by removing the request-integrity control WordPress uses to bind privileged actions to authenticated sessions.

Attack Vector

An attacker registers or uses an existing low-privileged account on the target site. The attacker then issues authenticated POST requests to wp-admin/admin-ajax.php targeting the vulnerable action while enumerating sequential or predictable payment identifiers. Each successful response leaks the payment details of another member. See the WPScan Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-14847

Indicators of Compromise

Repeated authenticated POST requests to admin-ajax.php from a single Subscriber-level account
Sequential or brute-force patterns on payment identifier parameters in AJAX request bodies
Elevated volumes of successful HTTP 200 responses to the vulnerable payment action from non-administrative accounts
Newly registered Subscriber accounts issuing AJAX traffic outside normal member workflows

Detection Strategies

Parse web server access logs for high-frequency admin-ajax.php requests referencing the plugin's payment action parameter
Alert on any authenticated user submitting more than a small threshold of distinct payment identifiers within a short window
Correlate account creation events with subsequent AJAX enumeration activity to identify throwaway attacker accounts

Monitoring Recommendations

Enable WordPress and web application firewall (WAF) request logging with full query parameters retained
Ingest WordPress and reverse proxy logs into a centralized analytics platform to support enumeration pattern queries
Monitor the plugin version across all WordPress instances and flag hosts running versions prior to 3.0.7

How to Mitigate CVE-2026-14847

Immediate Actions Required

Update the Paid Membership Subscriptions plugin to version 3.0.7 or later on all WordPress sites
Audit recent AJAX request logs for enumeration of payment identifiers by Subscriber-level accounts
Review and remove unrecognized or dormant Subscriber accounts created before the update

Patch Information

Upgrade the Paid Membership Subscriptions plugin to version 3.0.7 or later. The fixed release adds the missing capability and nonce checks on the affected AJAX action. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Disable open user registration or restrict registration to trusted email domains until the plugin is updated
Deploy a WAF rule blocking Subscriber-level requests to the vulnerable AJAX action parameter
Temporarily deactivate the plugin on sites that cannot be patched immediately if payment data confidentiality is critical

bash

# WP-CLI: update the plugin to a fixed version across a site
wp plugin update paid-member-subscriptions --version=3.0.7
wp plugin list --name=paid-member-subscriptions --fields=name,status,version