Paid Member Subscriptions < 3.0.7 – Unauthenticated Sensitive Information Exposure via Residual Export Files | CVE 2026-14849

Description

The plugin does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.

Proof of Concept

Prerequisites: Paid Member Subscriptions active with at least one member/payment record.

1. Unauthenticated, confirm the artifact does not yet exist:
   curl -i https://victim.example/wp-content/uploads/pms-members.csv    (404)
   curl -i https://victim.example/wp-content/uploads/pms-payments.csv   (404)

2. As an administrator, start a Member (or Payment) export from the Paid Member Subscriptions export interface. Let the CSV generate, then interrupt the workflow before the final download/cleanup step completes (close the tab, navigate away, or log out).

3. Unauthenticated, fetch the predictable export URL directly:
   curl -i https://victim.example/wp-content/uploads/pms-members.csv
   curl -i https://victim.example/wp-content/uploads/pms-payments.csv

Expected: HTTP 200 with the generated CSV, exposing member/payment PII (username, email, first_name, last_name, subscription status/dates, payment_id, transaction_id, amount, ip_address; more if "Include Sensitive Data" was enabled).

The file persists until a later export overwrites it, the download/cleanup completes, or it is manually deleted.