Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.9 - Unauthenticated Unauthorized Subscription Activation

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.0.9. This is due to missing server-side token validation on the Stripe SCA resume AJAX endpoint, allowing any request that supplied a valid payment intent ID to drive the handler against arbitrary member subscriptions. This makes it possible for unauthenticated attackers to complete another member's Stripe SCA authentication flow using only a known payment intent ID, activating or altering a subscription without authorization.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Paid Membership Subscriptions 3.1.0 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts