CVE-2026-90951: Paid Membership Subscriptions Auth Bypass

CVE-2026-90951 Overview

CVE-2026-90951 affects the Paid Membership Subscriptions WordPress plugin in versions prior to 3.1.0. The plugin fails to bind one of its unauthenticated payment actions to the requesting user. An attacker who obtains another member's in-flight payment identifier can delete that member's checkout state. The flaw is categorized as an authorization issue [CWE-863].

Critical Impact
Unauthenticated attackers holding a valid payment identifier can disrupt another member's checkout flow, causing integrity impact to pending transactions.

Affected Products

Paid Membership Subscriptions WordPress plugin versions before 3.1.0

Discovery Timeline

2026-09-23 - CVE-2026-90951 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-90951

Vulnerability Analysis

The Paid Membership Subscriptions plugin exposes an unauthenticated payment action that operates on payment records without verifying that the requester owns the record. The action accepts an in-flight payment identifier and performs a state-changing operation, specifically deletion of the checkout state, based solely on the presence of that identifier. Any actor able to observe or guess a valid identifier can trigger the destructive path on behalf of another member.

The issue impacts transactional integrity rather than confidentiality. Successful abuse forces the targeted member out of the checkout process, which may require the victim to restart payment or resolve stale records with the site operator.

Root Cause

The root cause is a missing authorization check on an unauthenticated endpoint. The handler treats knowledge of the payment identifier as sufficient authority to act on the record. This pattern falls under [CWE-863] Incorrect Authorization, where the application performs an authorization decision using insufficient context.

Attack Vector

The attack is network-based and requires no authentication or user interaction from the victim. The attacker must possess a valid in-flight payment identifier belonging to another member. Attack complexity is elevated because the attacker must obtain that identifier through observation, leakage, or enumeration during the payment window. Refer to the WPScan Vulnerability Details for the technical write-up.

No verified public exploit code is available. The vulnerability is described in prose because no sanitized proof-of-concept has been released.

Detection Methods for CVE-2026-90951

Indicators of Compromise

Unexpected deletion of pending payment or checkout records in the Paid Membership Subscriptions database tables.
User complaints about interrupted checkout flows or missing pending memberships that were previously initiated.
HTTP requests to the plugin's unauthenticated payment action endpoint referencing payment identifiers not associated with the source session.

Detection Strategies

Review web server access logs for anonymous POST or GET requests to Paid Membership Subscriptions payment action URLs containing payment identifier parameters.
Correlate deletion events in wp_pms_payments or related plugin tables with the originating IP address and session context.
Alert on repeated requests from a single source cycling through sequential or high-entropy payment identifiers.

Monitoring Recommendations

Enable WordPress audit logging for plugin database modifications, focusing on Paid Membership Subscriptions tables.
Monitor payment funnel abandonment rates for statistically abnormal spikes that may indicate targeted disruption.
Track and rate-limit unauthenticated requests to plugin AJAX and REST endpoints.

How to Mitigate CVE-2026-90951

Immediate Actions Required

Upgrade the Paid Membership Subscriptions plugin to version 3.1.0 or later on all affected WordPress installations.
Audit recent payment and checkout tables for unexpected deletions and reconcile with member support tickets.
Restrict access to the WordPress site with a web application firewall while patching is scheduled.

Patch Information

The vendor addressed the authorization flaw in Paid Membership Subscriptions version 3.1.0. Site administrators should update through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Details advisory for confirmation of the fixed version.

Workarounds

Temporarily disable the Paid Membership Subscriptions plugin if upgrading immediately is not feasible and payment processing can be paused.
Apply web application firewall rules that block unauthenticated requests to the vulnerable plugin action until the patched version is deployed.
Ensure payment identifiers are transmitted only over TLS and not exposed in referrer headers, logs, or client-side storage.

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update paid-member-subscriptions --version=3.1.0
wp plugin list --name=paid-member-subscriptions --fields=name,status,version