CVE-2026-90951
Received Received - Intake

Unauthenticated Checkout Deletion in Paid Memberships Pro

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-90951
EUVD
EUVD-2026-85054

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
paid_membership_subscriptions paid_membership_subscriptions to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Paid Membership Subscriptions WordPress plugin before version 3.1.0. It involves an unauthenticated payment action that does not properly bind to the requesting user. An attacker can use another member's in-flight payment identifier to delete that member's checkout state.

Impact Analysis

An attacker could disrupt another user's payment process by deleting their checkout state, potentially causing loss of paid subscriptions or memberships. This could lead to financial or access issues for affected users.

Mitigation Strategies

Update the Paid Membership Subscriptions WordPress plugin to version 3.1.0 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90951. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart