CVE-2026-90951 in Paid Membership Subscriptions Plugin
Summary
by MITRE • 09/23/2026
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the Paid Membership Subscriptions plugin for WordPress prior to version 3.1.0 represents a critical flaw in session and transaction management logic within unauthenticated endpoints. The core issue stems from an improper binding of user context to specific payment actions, specifically affecting operations that handle checkout states during active transactions. In secure web application design, any action that modifies the state of a resource belonging to a specific user must strictly validate that the current request originates from or is authorized by that same user identity. However, in this implementation, the plugin fails to enforce such ownership checks on certain unauthenticated payment-related endpoints. This architectural oversight allows an attacker who intercepts or obtains another member's unique, in-flight payment identifier to manipulate the associated checkout process without possessing valid authentication credentials for that account.
From a technical perspective, the flaw lies in the server-side validation logic which relies solely on the presence of a transaction-specific token rather than verifying the association between that token and the authenticated session or user identity making the request. When an e-commerce plugin processes payments, it typically generates temporary identifiers to track the state of a checkout process as it moves through various stages such as cart initialization, payment gateway interaction, and final confirmation. These in-flight identifiers are often exposed via URLs, POST parameters, or cookies during normal operation. Because the vulnerable endpoints do not cross-reference these identifiers against the current user's session data or account ID, any party with knowledge of a valid identifier can interact with that transaction stream. This lack of binding effectively decouples the action from the actor, creating an opportunity for state manipulation attacks where external entities can interfere with legitimate user workflows.
The operational impact of this vulnerability is significant, particularly regarding data integrity and service availability within the subscription management system. An attacker exploiting this flaw can delete or corrupt a member's checkout state by sending crafted requests containing another user's in-flight payment identifier. This action effectively aborts the transaction for the victim, potentially causing them to lose their place in the purchase flow, resulting in frustration and potential financial loss if they must restart the process. Furthermore, depending on how the plugin handles subsequent steps after a deleted checkout state, this could lead to inconsistent database records where subscription statuses do not align with payment gateway confirmations. In more severe scenarios, if the deletion of checkout state triggers side effects such as inventory adjustments or email notifications, it could disrupt business operations and damage customer trust. The ability to manipulate these states without authentication also undermines the integrity of the sales funnel, making it difficult for administrators to accurately track conversion rates and revenue.
This vulnerability aligns with CWE-384, Session Fixation, although in this specific context, it is more accurately described as a lack of proper session binding or object reference validation issues similar to CWE-601, URL Redirection to Untrusted Site (Open Redirect) principles applied to internal state management. More precisely, it falls under the category of Broken Access Control where the application fails to enforce that users are authorized for any operation on their own data. In terms of the MITRE ATT&CK framework, this behavior is indicative of techniques related to Account Manipulation or potentially Defense Evasion if used to disrupt logging and monitoring by causing erratic transaction states. It highlights a common pitfall in WordPress plugin development where convenience overrides security best practices regarding stateful operations on unauthenticated endpoints.
To mitigate this vulnerability, immediate updates to version 3.1.0 of the Paid Membership Subscriptions plugin are required as they address these binding issues. For organizations unable to update immediately due to compatibility constraints or other operational reasons, several defensive measures can be implemented at the infrastructure level. Web Application Firewalls (WAFs) should be configured with rules that detect and block anomalous patterns in payment endpoint requests, particularly those involving rapid changes to checkout states from different IP addresses than where the session originated. Additionally, developers reviewing custom code or other plugins should ensure that all state-modifying actions verify both the validity of the transaction identifier and its strict association with the requesting user's identity through server-side session validation. Implementing CSRF tokens for these specific endpoints can also add a layer of protection by ensuring that requests originate from legitimate pages served to authenticated users, thereby preventing unauthorized third-party interactions even if an attacker possesses a valid payment ID.