Unauthorized Payment Details Disclosure in Paid Memberships Pro WordPress Plugin

Executive Summary

This is an Insecure Direct Object Reference (IDOR) flaw in the Paid Membership Subscriptions WordPress plugin before version 3.0.7. It allows authenticated users with Subscriber-level access or higher to view sensitive payment details of other members by exploiting a lack of capability or nonce checks in a payment-related AJAX action.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Paid Membership Subscriptions plugin version prior to 3.0.7. Inspect network traffic for AJAX requests to payment-related endpoints and verify if payment details can be accessed without proper authentication or nonce checks.

Useful 0 Not Useful 0

Impact Analysis

An attacker could disclose payment details such as Payment ID, date, amount, currency, and payment gateway of any member by enumerating payment identifiers. This could lead to privacy breaches and potential misuse of financial information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive payment and personal data, potentially resulting in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Paid Membership Subscriptions plugin to version 3.0.7 or later. If updating is not possible, consider disabling the plugin temporarily until a patch is applied. Review payment logs for unauthorized access and restrict Subscriber-level user permissions where possible.

Useful 0 Not Useful 0