MEDIUM 4.3 NVD

CVE-2026-14847

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowin

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.

References

https://wpscan.com/vulnerability/5cd6d414-8d7d-4627-9649-af092a1afb75/

Published: 2026-07-31 · Source: NVD · Feed updated: 2026-08-04

This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-07-31 via NVD.

vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.