WordPress Plugin Vulnerabilities

Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

Description

The plugin does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.

Proof of Concept

Affects Plugins

Plugin icon
paid-member-subscriptions
Fixed in 3.0.9

References

CVE
CVE-2026-90922

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Charles Vosburgh
Submitter
Charles Vosburgh
Submitter website
https://www.linkedin.com/in/charles-vosburgh/
Verified
Yes
WPVDB ID
a7f3882a-81d7-4915-b83c-10480eba493a

Timeline

Publicly Published
2026-09-15 (about 2 days ago)
Added
2026-09-15 (about 1 day ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2024-02-08
Title
Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access
Published
2025-03-06
Title
VK Blocks < 1.95.0.3 - Missing Authorization to Sensitive Information Exposure
Published
2021-05-07
Title
Leads-5050 Visitor Insights < 1.0.4 - Unauthenticated License Change
Published
2021-11-15
Title
Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access
Published
2021-09-21
Title
WP Mega Menu < 1.4.0 - Unauthenticated Arbitrary Post Access