WordPress Plugin Vulnerabilities

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 3.0.8 - Insecure Direct Object Reference

Description

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.7 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
paid-member-subscriptions
Fixed in 3.0.8

References

CVE
CVE-2026-59539
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8e94d308-8d36-487e-be72-e1599c4384f9

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
6ba0f57e-4098-4446-8312-b79793f3d309

Timeline

Publicly Published
2026-07-23 (about 2 months ago)
Added
2026-07-29 (about 2 months ago)
Last Updated
2026-07-29 (about 2 months ago)

Other

Published
Title
Published
2025-01-02
Title
WP Job Portal – A Complete Recruitment System for Company or Job Board website < 2.2.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2024-04-24
Title
SP Project & Document Manager <= 4.71 - Data Update via IDOR
Published
2026-04-16
Title
LatePoint < 5.4.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference via 'quantity'
Published
2026-08-15
Title
Password Protect WordPress Lite < 1.9.21 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update