CVE-2026-90950: Paid Membership Subscriptions Auth Bypass

CVE-2026-90950 Overview

CVE-2026-90950 affects the Paid Membership Subscriptions WordPress plugin in versions before 3.1.0. The plugin fails to verify the reCAPTCHA challenge on its registration handler when the expected form field is missing from the request. Unauthenticated attackers can register accounts on affected sites without solving the reCAPTCHA the administrator has enabled. The flaw is classified under CWE-693: Protection Mechanism Failure.

Critical Impact
Attackers can automate mass account creation on protected registration forms, bypassing the anti-abuse control that site owners rely on to block bots and spam signups.

Affected Products

Paid Membership Subscriptions WordPress plugin versions before 3.1.0
WordPress sites using the plugin's registration handler with reCAPTCHA enabled
Membership sites relying on reCAPTCHA as their primary bot mitigation

Discovery Timeline

2026-09-23 - CVE-2026-90950 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-90950

Vulnerability Analysis

The Paid Membership Subscriptions plugin exposes a registration handler that processes new user signups. Administrators can enable Google reCAPTCHA to prevent automated account creation. The handler validates the reCAPTCHA response only when the corresponding form field is present in the submitted request. When the field is absent, the plugin skips validation and proceeds with account creation.

This behavior turns a security control into an opt-in check that the client can disable. An attacker who omits the reCAPTCHA parameter avoids the challenge entirely while still submitting a valid registration payload. See the WPScan Vulnerability Report for the technical writeup.

Root Cause

The root cause is a protection mechanism failure [CWE-693]. The registration handler treats the absence of the reCAPTCHA field as "no validation required" instead of "validation failed." Secure implementations must fail closed when a required security parameter is missing rather than treating it as optional.

Attack Vector

The attack requires only network access to the target registration endpoint. An attacker crafts an HTTP POST request to the plugin's registration handler containing the required user fields but omitting the reCAPTCHA field. The server accepts the request and creates the account without any human verification. Attackers can script this pattern to create accounts at scale.

No verified exploit code has been published. Refer to the WPScan Vulnerability Report for details on the vulnerable code path.

Detection Methods for CVE-2026-90950

Indicators of Compromise

Spikes in newly registered accounts within short time windows on sites using the plugin
Registration requests to the plugin handler that lack the expected g-recaptcha-response or equivalent field
Multiple registrations originating from the same IP or user-agent cluster
Accounts created with disposable email domains or programmatic username patterns

Detection Strategies

Inspect web server access logs for POST requests to the Paid Membership Subscriptions registration endpoint and correlate against expected reCAPTCHA parameters
Compare the plugin version installed across managed WordPress sites against the fixed release 3.1.0
Alert on registration success events that lack a corresponding reCAPTCHA verification call to Google's siteverify API

Monitoring Recommendations

Enable WordPress user registration auditing and forward events to a central log store
Track baseline registration rates per site and alert on statistical deviations
Monitor outbound calls to www.google.com/recaptcha/api/siteverify from the WordPress host and flag registration events without matching verifications

How to Mitigate CVE-2026-90950

Immediate Actions Required

Update the Paid Membership Subscriptions plugin to version 3.1.0 or later on all WordPress installations
Audit user accounts created since the vulnerable version was deployed and disable suspicious registrations
Reset passwords or require email reverification for accounts of unclear provenance

Patch Information

The vendor addressed the issue in Paid Membership Subscriptions 3.1.0. The fix ensures the reCAPTCHA validation runs regardless of whether the form field is present, treating a missing field as a failed check. Refer to the WPScan Vulnerability Report for reference to the fixed version.

Workarounds

Temporarily disable public registration on affected sites until the plugin is updated
Place a Web Application Firewall (WAF) rule in front of the registration endpoint that rejects requests missing the g-recaptcha-response parameter
Add a secondary anti-bot control such as an alternative CAPTCHA plugin or rate limiting on the registration route

bash

# Example WAF rule concept - block registration POSTs missing the reCAPTCHA field
# ModSecurity-style pseudocode
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1029095,\
   msg:'PMS registration missing reCAPTCHA field'"
  SecRule REQUEST_URI "@contains /?pms_register" \
    "chain"
    SecRule &ARGS:g-recaptcha-response "@eq 0"