CVE-2026-57659: Paid Memberships Pro CSRF Vulnerability

CVE-2026-57659 Overview

CVE-2026-57659 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affecting the Paid Memberships Pro - Add Member From Admin plugin for WordPress in versions up to and including 0.7.2. The flaw allows attackers to trigger privileged actions in the plugin by tricking an authenticated administrator into visiting a malicious page. Successful exploitation can result in the addition of arbitrary members, undermining membership integrity and site access controls. The vulnerability maps to CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can forge state-changing requests on behalf of a logged-in WordPress administrator, adding members and impacting confidentiality, integrity, and availability of the site.

Affected Products

WordPress plugin: Paid Memberships Pro - Add Member From Admin (pmpro-add-member-admin)
Versions: <= 0.7.2
Deployment: WordPress sites using the affected plugin

Discovery Timeline

2026-06-26 - CVE-2026-57659 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57659

Vulnerability Analysis

The vulnerability stems from missing anti-CSRF protections on administrative actions exposed by the Paid Memberships Pro - Add Member From Admin plugin. State-changing endpoints in the plugin accept requests without validating a WordPress nonce or verifying request origin. An attacker crafts a malicious HTML page or link that submits a forged request to the vulnerable endpoint. When a logged-in administrator visits the attacker-controlled resource, the browser automatically includes the administrator's session cookies. The request is processed with administrator privileges, executing the attacker-controlled action such as adding a paid member. User interaction is required, which aligns with the UI:R attribute of the CVSS vector.

Root Cause

The root cause is the absence of a valid nonce check on administrative form handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives that plugins must use to bind sensitive actions to a specific user session. The affected plugin versions omit or incorrectly implement these checks, leaving privileged operations exposed to cross-origin request forgery.

Attack Vector

Exploitation occurs over the network through the victim's browser. The attacker hosts a page containing an auto-submitting form or image tag that targets the vulnerable admin endpoint. Delivery methods include phishing emails, forum posts, comments, or advertisements that lure administrators. The attacker does not require any credentials on the target site. Refer to the Patchstack Vulnerability Report for technical details of the affected request handler.

Detection Methods for CVE-2026-57659

Indicators of Compromise

Unexpected new member accounts created in Paid Memberships Pro without corresponding administrator activity in audit logs.
HTTP POST requests to the plugin's admin endpoints with Referer headers pointing to external or unrelated domains.
Administrator sessions showing action bursts immediately after visiting external links or email content.

Detection Strategies

Inspect web server access logs for admin-area requests where the Referer header is missing or does not match the site's own origin.
Correlate WordPress user and membership creation events with the authenticated administrator's browsing timeline to identify forged actions.
Deploy a Web Application Firewall (WAF) rule to flag POST requests to pmpro-add-member-admin endpoints that lack a valid _wpnonce parameter.

Monitoring Recommendations

Enable WordPress audit logging for user, role, and membership changes and forward events to a central SIEM.
Alert on membership additions occurring outside business hours or from unusual administrator client IPs.
Monitor plugin file integrity and version metadata to confirm the plugin has been upgraded past 0.7.2.

How to Mitigate CVE-2026-57659

Immediate Actions Required

Update the Paid Memberships Pro - Add Member From Admin plugin to a version later than 0.7.2 as soon as a fixed release is available.
Audit existing memberships and user accounts for entries created without a corresponding administrative action.
Force password resets and terminate active sessions for administrator accounts that may have been targeted.

Patch Information

Consult the Patchstack Vulnerability Report for the current patch status and vendor guidance. Apply the vendor-supplied update through the WordPress plugin manager once released, and verify the installed version reflects the patched build.

Workarounds

Deactivate the plugin until a patched version is installed if administrators cannot avoid untrusted browsing contexts.
Restrict /wp-admin/ access by source IP through the web server or WAF to limit exposure of authenticated administrator sessions.
Require administrators to use isolated browser profiles for WordPress management, reducing the risk of cross-site request forgery from other tabs.
Enforce strict SameSite=Lax or SameSite=Strict cookie attributes for WordPress authentication cookies where compatible.

bash

# Example: block admin-ajax and admin-post requests missing a nonce parameter
# (illustrative nginx snippet - adapt to your environment)
location ~ ^/wp-admin/(admin-ajax|admin-post)\.php$ {
    if ($request_method = POST) {
        if ($arg__wpnonce = "") { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}