CVE-2026-90922: WordPress Paid Membership Auth Bypass Flaw

CVE-2026-90922 Overview

CVE-2026-90922 affects the Paid Membership Subscriptions WordPress plugin in versions prior to 3.0.9. The plugin fails to verify that the amount and currency reported by the payment provider match the pending payment before completing the transaction. Unauthenticated users can exploit this flaw to obtain paid memberships by submitting arbitrary lower amounts. The weakness is categorized under [CWE-284] Improper Access Control and reflects a business logic error in the payment reconciliation workflow.

Critical Impact
Unauthenticated attackers can acquire paid memberships for less than the advertised price, causing direct revenue loss to site operators using the plugin for subscription monetization.

Affected Products

Paid Membership Subscriptions WordPress plugin versions before 3.0.9
WordPress sites processing paid subscriptions through the affected plugin
Deployments integrating third-party payment providers via the plugin

Discovery Timeline

2026-09-17 - CVE-2026-90922 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-90922

Vulnerability Analysis

The vulnerability resides in the payment completion routine of the Paid Membership Subscriptions plugin. When a payment provider notifies the plugin about a completed transaction, the plugin marks the associated pending payment as complete. It does not validate that the returned amount and currency match the amount and currency of the pending order.

This missing validation converts a trust boundary into an attacker-controlled input. An unauthenticated user can initiate a checkout for a paid membership, then complete the payment step for a much smaller amount or a different currency. The plugin still activates the membership as if the full amount had been paid.

The issue is a business logic flaw rather than a memory safety or injection defect. It fits the Improper Access Control weakness class because the plugin grants membership entitlements without verifying the financial precondition.

Root Cause

The root cause is missing server-side reconciliation between the pending payment record and the payment provider callback. Amount and currency fields returned by the provider are accepted without comparison against the expected values stored in the plugin database.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker initiates the standard subscription checkout flow, then manipulates the payment step to submit a lower amount to the configured payment provider. Once the provider confirms the reduced payment, the plugin completes the pending record and grants the paid membership. Full technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-90922

Indicators of Compromise

Membership activations linked to payments with amounts lower than the configured membership price.
Payment provider transactions with currencies that do not match the site's configured currency.
New active memberships tied to accounts or email addresses with no prior interaction history.

Detection Strategies

Reconcile plugin membership activation records against payment provider settlement reports and flag discrepancies in amount or currency.
Audit the wp_pms_member_subscriptions and payment log tables for completed subscriptions with abnormal payment values.
Review web server access logs for repeated checkout initiations from the same IP range followed by successful membership activations.

Monitoring Recommendations

Alert on any membership activation where the recorded payment amount is below the plugin's configured plan price.
Monitor payment provider webhooks and callback endpoints for unexpected currency codes.
Track new membership creation velocity and investigate spikes that correlate with unauthenticated checkout traffic.

How to Mitigate CVE-2026-90922

Immediate Actions Required

Upgrade the Paid Membership Subscriptions plugin to version 3.0.9 or later on all WordPress sites.
Audit all memberships created before the upgrade and revoke entitlements associated with underpaid transactions.
Enable transaction-level logging in the payment provider dashboard to support ongoing reconciliation.

Patch Information

The plugin vendor addressed the flaw in version 3.0.9 by enforcing verification of both amount and currency against the pending payment before completion. Refer to the WPScan Vulnerability Report for advisory details and the fixed release.

Workarounds

Restrict the payment callback endpoint to known payment provider IP ranges at the web server or WAF layer.
Temporarily disable paid membership signups until the upgrade to 3.0.9 is deployed.
Manually reconcile every new membership activation against payment provider reports until the patched version is in place.

bash

# Upgrade the plugin via WP-CLI
wp plugin update paid-member-subscriptions --version=3.0.9
wp plugin list --name=paid-member-subscriptions --fields=name,status,version