Unauthenticated Access Bypass in Paid Member Subscriptions

Executive Summary

CVE-2026-97249 is an unauthenticated bypass vulnerability in the WordPress Paid Member Subscriptions plugin versions 3.0.9 and earlier. It allows attackers to bypass security checks without authentication, enabling unauthorized access to restricted features or data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of the Paid Member Subscriptions plugin. If it is version 3.0.9 or earlier, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin files directly.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to access paid or restricted content without proper authorization. While classified as low severity, it may lead to unauthorized data exposure or service misuse if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated bypass of security checks, which could lead to unauthorized access to sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by increasing the risk of data breaches or unauthorized exposure of personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Paid Member Subscriptions plugin to version 3.1.0 or later to resolve the vulnerability. Enable auto-updates for vulnerable plugins if using Patchstack to mitigate the risk.

Useful 0 Not Useful 0