CVE-2026-57659

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro - Add Member From Admin versions prior to 0.7.3

Description An unauthenticated Cross-Site Request Forgery (CSRF) exists in the Paid Memberships Pro - Add Member From Admin plugin for WordPress. This issue occurs due to missing or incorrect nonce validation—a security token used to verify that a request was intentionally sent by the user—on a function. This allows unauthenticated attackers to perform unauthorized actions by tricking a site administrator into clicking a crafted link.

Recommendations Update to a version newer than 0.7.2.