CVE-2026-14847

UNKNOWN 0.0

Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.

Vendor	unknown
Product	paid membership subscriptions
Published	Jul 31, 2026

Stay Ahead of the Next One

Get instant alerts for unknown paid membership subscriptions

Be the first to know when new unknown vulnerabilities affecting unknown paid membership subscriptions are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Paid Membership Subscriptions

0 < 3.0.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/5cd6d414-8d7d-4627-9649-af092a1afb75/

Credits

WEI HSIANG WANG WPScan