Kadence Memberships 3.2.17 - 4.0.5 - Subscriber+ Stripe Client Secret Disclosure and Payment Method Manipulation via IDOR

Description

The plugin does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing to another member's pending payment.