CVE-2023-6187 in Paid Memberships Pro Plugin
Summary
by MITRE • 11/18/2023
The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-6187 affects the Paid Memberships Pro plugin for WordPress, a widely used membership management solution that has been impacted by a critical security flaw in versions up to and including 2.12.3. This vulnerability stems from inadequate file type validation within the pmpro_paypalexpress_session_vars_for_user_fields function, creating a pathway for malicious exploitation that could lead to complete system compromise.
The technical flaw resides in the plugin's insufficient validation of file uploads when processing payment methods such as 2Checkout or PayPal Express. Attackers with subscriber privileges or higher can leverage this weakness to upload malicious files to the target server through the custom user field functionality. The vulnerability specifically manifests when custom user fields are configured to be visible only at the profile level and not at checkout, creating an unexpected upload pathway that bypasses normal security controls. This represents a classic case of insecure file upload handling where the plugin fails to properly validate file extensions, MIME types, or file contents before allowing uploads to proceed.
The operational impact of this vulnerability is severe and potentially catastrophic for affected WordPress installations. An authenticated attacker can execute arbitrary code on the compromised server, potentially leading to full system compromise, data theft, or service disruption. The attack vector requires only subscriber-level privileges, making it particularly dangerous as it can be exploited by users who have legitimate access to the membership system but should not have the ability to upload malicious files. This vulnerability can be exploited to establish persistent backdoors, exfiltrate sensitive user data, or deploy additional malware payloads, making it a significant threat to WordPress site security.
Organizations using the affected plugin versions should immediately implement mitigation strategies to protect their systems. The primary recommendation is to update to the latest version of the Paid Memberships Pro plugin where this vulnerability has been addressed. Additionally, administrators should review and restrict custom user field configurations to minimize potential attack surfaces, particularly disabling file upload capabilities for fields that are not essential for legitimate business operations. Network monitoring should be enhanced to detect unusual file upload activities, and security controls such as web application firewalls should be configured to block suspicious file upload patterns. This vulnerability aligns with CWE-434 which addresses insecure file upload handling and represents a significant concern under the ATT&CK framework category of T1505.003 for Unsecured Credentials and T1059.001 for Command and Scripting Interpreter, as it enables both code execution and potential credential compromise through the uploaded files.