Maciek Komorowski

An issue exists where the plugin fails to verify if a discount coupon applied to a paid membership plan is valid for that specific plan. This allows unauthenticated users to apply a coupon that makes the order fully discounted, which the system then treats as paid. Consequently, users can be granted the role associated with a paid plan without payment, potentially leading to privilege escalation to the administrator level if the plan is mapped to a privileged role.

An unauthenticated AJAX action fails to verify if a requested post is publicly viewable, relying solely on the published status rather than the post type's visibility. This allows unauthenticated users to disclose content from non-public post types, such as captured contact-form submissions containing names, email addresses, and messages.