CVE-2026-14848: Paid Membership Subscriptions Auth Bypass

CVE-2026-14848 Overview

CVE-2026-14848 is a broken access control vulnerability in the Paid Membership Subscriptions WordPress plugin before version 3.0.8. The plugin fails to verify that the subscription being modified through the change-subscription checkout flow belongs to the current user. Any authenticated user holding Subscriber-level access or above can take over another member's subscription. The attacker can overwrite the target subscription's plan, status, and expiration. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact
Authenticated low-privilege users can hijack other members' paid subscriptions and modify plan, status, and expiration values on affected sites.

Affected Products

Paid Membership Subscriptions WordPress plugin versions prior to 3.0.8
WordPress sites exposing the change-subscription checkout endpoint to Subscriber-level accounts
Membership sites relying on this plugin for paid access control

Discovery Timeline

2026-08-04 - CVE-2026-14848 published to the National Vulnerability Database
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-14848

Vulnerability Analysis

The Paid Membership Subscriptions plugin exposes a checkout workflow that lets members change an existing subscription. The change-subscription handler accepts a subscription identifier supplied by the request. It does not verify that the identifier maps to a subscription owned by the currently authenticated user. As a result, an attacker with a Subscriber account can submit another member's subscription identifier and drive the change flow against that record.

Once the request is accepted, the plugin overwrites core subscription fields on the targeted record, including plan, status, and expiration. This lets an attacker downgrade or cancel a legitimate member's subscription, or extend and modify their own subscription by pivoting through another account. The impact is limited to subscription state manipulation rather than full site compromise, but it directly undermines paid access controls and revenue integrity.

Root Cause

The root cause is a missing ownership check in the change-subscription handler. The code trusts a client-supplied subscription identifier and loads the record without confirming that the record's user identifier matches the authenticated session. This is a textbook Insecure Direct Object Reference pattern falling under CWE-284.

Attack Vector

Exploitation requires an authenticated account with Subscriber-level permissions or higher, which many membership sites grant to any registered visitor. The attacker submits a crafted change-subscription checkout request that references a victim's subscription identifier. No user interaction from the victim is required. The plugin processes the request and rewrites the victim's plan, status, and expiration according to attacker-controlled parameters.

The vulnerability is described in prose only; no verified exploit code is published in the referenced advisory. See the WPScan Vulnerability Report for the disclosure record.

Detection Methods for CVE-2026-14848

Indicators of Compromise

Change-subscription checkout requests where the submitted subscription identifier does not belong to the requesting user account
Unexpected modifications to subscription plan, status, or expiration fields in the plugin's database tables
Support tickets from members reporting lost access, unexpected plan changes, or altered renewal dates
Subscriber-level accounts issuing repeated checkout POST requests across a range of subscription identifiers

Detection Strategies

Audit web server access logs for POST requests to the plugin's change-subscription checkout endpoint originating from low-privilege sessions
Compare subscription record ownership against the acting user identifier in application logs and flag mismatches
Enable WordPress action and database auditing to capture writes to subscription tables with the initiating user context

Monitoring Recommendations

Alert on bulk or sequential subscription identifier enumeration from a single authenticated session
Monitor for out-of-band changes to subscription status transitioning paid members to canceled or expired states
Correlate authentication events for Subscriber accounts with subsequent subscription state changes for anomaly review

How to Mitigate CVE-2026-14848

Immediate Actions Required

Update the Paid Membership Subscriptions plugin to version 3.0.8 or later on all WordPress instances
Review recent subscription changes since the plugin was installed and reconcile against expected member activity
Force re-authentication and audit Subscriber-level accounts for signs of abuse
Restrict new user registration where the site does not require self-service Subscriber accounts

Patch Information

The vendor addressed the missing ownership check in Paid Membership Subscriptions 3.0.8. Administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Details are tracked in the WPScan Vulnerability Report.

Workarounds

Temporarily disable the change-subscription checkout flow or the plugin itself until the update to 3.0.8 is applied
Apply a Web Application Firewall rule that blocks change-subscription checkout requests where the submitted subscription identifier does not match the session user
Reduce the default role for new registrations below Subscriber where the site's membership model allows it

bash

# Example: update the plugin from the WordPress CLI
wp plugin update paid-memberships-subscriptions --version=3.0.8
wp plugin list --name=paid-memberships-subscriptions --fields=name,status,version