CVE-2026-14849
Received Received - Intake

Unauthenticated File Download in Paid Membership Subscriptions WordPress Plugin

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-14849
EUVD
EUVD-2026-51417

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
paid_membership_subscriptions plugin to 3.0.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Paid Membership Subscriptions WordPress plugin before version 3.0.7. It allows unauthenticated users to access and download exported member and payment data, including personally identifiable information (PII), by exploiting predictable file locations in the uploads directory.

Detection Guidance

Check for files in the WordPress uploads directory with predictable names like 'member_export.csv' or 'payment_export.csv'. Use commands like 'find /path/to/uploads -name "*export*"' to locate them.

Impact Analysis

If you use this plugin, attackers could steal sensitive member and payment data, including PII, leading to privacy breaches, identity theft, or financial fraud. The impact includes reputational damage and potential legal consequences.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to PII. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related information. Non-compliance could result in fines or penalties.

Mitigation Strategies

Update the Paid Membership Subscriptions plugin to version 3.0.7 or later. Remove any existing export files from the uploads directory and restrict access to sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14849. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart