Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Paid Membership Subscriptions 3.1.0 Clear all filters
TI-2026-61814 CVE-2026-90950 · GHSA-4p9q-3q6w-vc23

Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form

Priority LOW 30

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts wi…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-09-23 Fixed in 3.1.0 CWE-693
TI-2026-61815 CVE-2026-90951 · GHSA-rxfw-g454-gj22

Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment

Priority LOW 17

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00242 Published 2026-09-23 Fixed in 3.1.0 CWE-863