CVE-2026-4100: Paid Memberships Pro Auth Bypass Flaw

CVE-2026-4100 Overview

CVE-2026-4100 affects the Paid Memberships Pro plugin for WordPress in all versions up to and including 3.6.5. The vulnerability stems from missing capability checks on three Stripe webhook AJAX handlers: wp_ajax_pmpro_stripe_create_webhook, wp_ajax_pmpro_stripe_delete_webhook, and wp_ajax_pmpro_stripe_rebuild_webhook. Authenticated attackers with Subscriber-level access or higher can delete, create, or rebuild the site's Stripe webhook configuration. The flaw is categorized as Missing Authorization [CWE-862].

Critical Impact

Attackers can disrupt all payment processing, subscription renewal synchronization, cancellation handling, and failed payment management on affected WordPress sites.

Affected Products

• Paid Memberships Pro plugin for WordPress, versions through 3.6.5
• WordPress sites integrating Stripe payments via Paid Memberships Pro
• Membership-driven sites relying on Stripe webhook event delivery

Discovery Timeline

• 2026-05-02 - CVE-2026-4100 published to the National Vulnerability Database (NVD)
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-4100

Vulnerability Analysis

The Paid Memberships Pro plugin exposes three AJAX endpoints to manage the integration between WordPress and Stripe webhooks. These endpoints register handlers that allow administrators to create, delete, and rebuild webhook configurations through the WordPress admin interface.

The handlers are registered to the wp_ajax_* action hooks, which authenticate any logged-in user. The plugin does not validate that the requesting user holds an administrative capability before performing the webhook operation. As a result, low-privileged accounts including Subscribers can invoke these endpoints and manipulate Stripe webhook state.

Webhook disruption breaks the asynchronous event channel between Stripe and the site. Subscription renewals, cancellation events, payment failures, and refund notifications stop reaching the plugin. Member access state and billing records drift out of sync with Stripe, producing financial and operational impact even though no payment data is directly disclosed.

Root Cause

The root cause is a Broken Access Control issue [CWE-862]. The AJAX handlers rely solely on authentication, omitting a current_user_can() capability check or a properly scoped nonce verification. Any authenticated session token is sufficient to reach the privileged webhook management code path.

Attack Vector

Exploitation requires network access to the WordPress site and a valid authenticated session at the Subscriber role or higher. WordPress sites that allow open user registration are exposed to anonymous adversaries who can self-register a Subscriber account. The attacker issues an authenticated POST request to admin-ajax.php with the vulnerable action parameter to create, delete, or rebuild the Stripe webhook. No user interaction from an administrator is required.

The vulnerability mechanism is described in the Wordfence Vulnerability Report and the upstream code change is tracked in the GitHub Pull Request Update.

Detection Methods for CVE-2026-4100

Indicators of Compromise

• Unexpected POST requests to /wp-admin/admin-ajax.php containing action=pmpro_stripe_create_webhook, action=pmpro_stripe_delete_webhook, or action=pmpro_stripe_rebuild_webhook from non-administrator sessions.
• Stripe Dashboard showing webhook endpoints that were unexpectedly created, deleted, or recreated outside change windows.
• Gaps in Stripe event delivery logs correlating with subscription state desynchronization in the site's membership database.

Detection Strategies

• Correlate WordPress access logs with the authenticated user's role at request time and alert when Subscriber-level accounts trigger PMPro Stripe AJAX actions.
• Monitor Stripe API audit logs for webhook_endpoint.created, webhook_endpoint.deleted, and webhook_endpoint.updated events that do not match a planned administrator activity.
• Alert on first-time invocation of pmpro_stripe_*_webhook AJAX actions from any user account in production.

Monitoring Recommendations

• Enable verbose logging on admin-ajax.php and forward records to a SIEM for retention and correlation.
• Track new user registrations alongside privileged AJAX action usage to surface registration-then-exploit patterns.
• Review Stripe webhook delivery health daily and alert on sustained delivery failures or signing secret rotations.

How to Mitigate CVE-2026-4100

Immediate Actions Required

• Update the Paid Memberships Pro plugin to a version newer than 3.6.5 that includes the capability check fix.
• Audit the Stripe Dashboard for unauthorized webhook endpoint creations or deletions and restore the legitimate configuration.
• Review WordPress user accounts and remove unrecognized Subscriber-level registrations created during the exposure window.
• Rotate Stripe webhook signing secrets after restoring the correct webhook endpoint.

Patch Information

The fix introduces capability validation on the affected AJAX handlers. The upstream code change is published in the GitHub Pull Request Update. Apply the patched plugin release through the WordPress plugin updater or by replacing plugin files via deployment automation, then verify the version reported in wp-admin matches the patched build.

Workarounds

• Disable open user registration in wp-admin → Settings → General until the patch is applied.
• Restrict access to /wp-admin/admin-ajax.php for the pmpro_stripe_*_webhook actions using a Web Application Firewall (WAF) rule.
• Temporarily deactivate the Paid Memberships Pro plugin if Stripe payment processing can be paused during patching.
• Manage Stripe webhooks directly from the Stripe Dashboard rather than through the plugin UI until remediation is verified.

# Configuration example: WAF rule pattern to block exploitation attempts
# Block low-privilege POSTs to the vulnerable AJAX actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1004100,msg:'Block CVE-2026-4100 PMPro Stripe webhook AJAX'"
  SecRule ARGS:action "@rx ^pmpro_stripe_(create|delete|rebuild)_webhook$"