CVE-2026-90951

LOWCVSS 3.7

Description

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.

Timeline

Published:September 23rd, 2026 6:17 AM

Last modified:September 23rd, 2026 6:12 PM

CVSS Scoring

CVSS v3: 3.7 (LOW)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-863

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/bf740af6-3674-461e-83f0-22bd5c5b3378/

Source: NIST NVD · Data may lag official sources by up to one minute