Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Paid Membership Subscriptions 3.0.7 Clear all filters
TI-2026-12519 CVE-2026-14849 · GHSA-wv4h-qxh7-5899

Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files

Priority MEDIUM 51

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to downloa…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.0028 Published 2026-07-31 Fixed in 3.0.7 CWE-552
TI-2026-12517 CVE-2026-14847 · GHSA-9922-j5r7-r6hp

Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

Priority MEDIUM 53

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and abo…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-07-31 Fixed in 3.0.7 CWE-639