CVE-2026-14849: Paid Membership Subscriptions Plugin Flaw

CVE-2026-14849 Overview

CVE-2026-14849 affects the Paid Membership Subscriptions WordPress plugin before version 3.0.7. The plugin writes member and payment export files to a predictable location inside the WordPress uploads directory. It does not restrict access to these files. Unauthenticated attackers who guess or discover the file path can download exported member and payment data, including personally identifiable information (PII), while an export artifact remains on disk. The issue is classified under CWE-552: Files or Directories Accessible to External Parties.

Critical Impact
Unauthenticated attackers can retrieve exported member and payment records containing PII whenever an export file exists in the predictable uploads path.

Affected Products

Paid Membership Subscriptions WordPress plugin versions prior to 3.0.7
WordPress sites that generate member or payment exports through the plugin
Sites retaining export artifacts in the default uploads directory

Discovery Timeline

2026-07-31 - CVE-2026-14849 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-14849

Vulnerability Analysis

The Paid Membership Subscriptions plugin generates CSV export artifacts when administrators export member lists or payment records. The plugin writes these files to a predictable path within the WordPress wp-content/uploads/ directory. The exported files are not protected by authentication checks, .htaccess restrictions, randomized filenames, or nonces.

Any remote actor who requests the export URL directly can download the file. The exposure persists for as long as the artifact remains on disk after an administrator triggers an export. Exposed data includes member identifiers, email addresses, subscription details, and payment metadata that qualify as PII under most privacy regimes.

Root Cause

The root cause is a broken access control pattern combined with predictable file naming. The plugin trusts the obscurity of the upload path rather than enforcing server-side authorization. Because WordPress serves files under wp-content/uploads/ directly through the web server, no PHP handler is invoked to validate the requesting user's session or capability.

Attack Vector

Exploitation requires network access to the target WordPress site and knowledge or enumeration of the predictable export path. An attacker issues an unauthenticated HTTP GET request to the export file URL. If an administrator has recently generated an export and the file has not been deleted, the server returns the CSV contents. The high attack complexity reflects the requirement that an export artifact must be present at request time.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-14849

Indicators of Compromise

Unauthenticated HTTP GET requests targeting export file paths under wp-content/uploads/ associated with the Paid Membership Subscriptions plugin.
Web server access logs showing successful 200 responses for CSV files downloaded by unauthenticated clients.
Access to export artifacts from IP addresses that never authenticated to the WordPress admin interface.

Detection Strategies

Review web server access logs for direct requests to CSV files under the plugin's export directory.
Compare export file access events against known administrator sessions and source IP addresses.
Alert on requests to wp-content/uploads/ paths that return CSV content-types to unauthenticated clients.

Monitoring Recommendations

Enable verbose access logging on the WordPress web server and forward logs to a centralized analytics platform.
Track file creation events for CSV artifacts inside wp-content/uploads/ to correlate export generation with subsequent downloads.
Monitor for repeated enumeration requests that iterate over predictable export filenames.

How to Mitigate CVE-2026-14849

Immediate Actions Required

Upgrade the Paid Membership Subscriptions plugin to version 3.0.7 or later on all WordPress sites.
Delete any residual export CSV files currently stored under wp-content/uploads/ that the plugin has generated.
Audit web server logs for prior unauthenticated access to export artifacts and notify affected members if PII was retrieved.

Patch Information

The vendor addressed CVE-2026-14849 in Paid Membership Subscriptions version 3.0.7. Site operators should apply the update through the WordPress plugin manager or via WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict direct access to wp-content/uploads/ export subdirectories using web server rules until the patch is applied.
Remove export files immediately after administrators download them, and avoid retaining historical exports on the filesystem.
Move exports to a directory outside the web root or protect them with authenticated download handlers.

bash

# Apache: block direct access to plugin export CSVs
<FilesMatch "\.csv$">
    Require all denied
</FilesMatch>

# Nginx equivalent (place inside the server block)
location ~* /wp-content/uploads/.*\.csv$ {
    deny all;
    return 403;
}

# WP-CLI: update the vulnerable plugin
wp plugin update paid-member-subscriptions --version=3.0.7