Paid Member Subscriptions < 3.0.7 – Subscriber+ Payment Data Disclosure via IDOR | CVE 2026-14847

Description

The plugin does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.

Proof of Concept

Prerequisites: Paid Member Subscriptions active with at least one payment record (Members > Payments). An attacker account at Subscriber role that owns no payments.

1. Log in as the Subscriber attacker.
2. From the browser console (the request carries the login cookie), POST to admin-ajax.php:

   fetch('/wp-admin/admin-ajax.php', {
     method: 'POST',
     credentials: 'include',
     headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
     body: 'action=render_modal_payment_refund&pms_payment_id=1'
   }).then(r => r.json()).then(d => console.log(d.data.html));

3. The JSON response returns the refund modal HTML for payment #1, a payment the attacker does not own, disclosing Payment ID, Date, Amount + currency, and Gateway. Increment pms_payment_id (1,2,3,...) to enumerate every payment.

Negative controls:
- Unauthenticated (no cookie): admin-ajax returns "0" (the action has no nopriv handler).
- Using the leaked refund nonce (pmstkn) to POST action=pms_process_refund is rejected with "You do not have the required capabilities to perform this action." This is disclosure only, no refund write.