WordPress Plugin Vulnerabilities

Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form

Description

The plugin does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.

Proof of Concept

Affects Plugins

Plugin icon
paid-member-subscriptions
Fixed in 3.1.0

References

CVE
CVE-2026-90950

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
685f381e-97b5-4855-a0ca-5854043a7b9e

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2026-09-14
Title
Really Simple Security < 9.8.2 - Subscriber+ Enforced 2FA Bypass via Grace Period Reset
Published
2020-04-29
Title
WordPress < 5.4.1 - Unauthenticated Users View Private Posts
Published
2025-07-24
Title
PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API
Published
2024-04-12
Title
Download Manager < 3.2.83 - Unauthenticated Password Protected File Bypass
Published
2025-11-26
Title
SKT PayPal for WooCommerce < 1.5 - Unauthenticated Payment Bypass