CVE-2026-14848

Name of the Vulnerable Software and Affected Versions Paid Membership Subscriptions versions prior to 3.0.8

Description The plugin fails to verify if the subscription being modified during the change-subscription checkout process belongs to the authenticated user. This allows any user with Subscriber-level access or higher to hijack another member's subscription and overwrite its plan, status, and expiration date via the process checkout function.

Recommendations Update Paid Membership Subscriptions to version 3.0.8 or later.