UNKNOWN NVD

CVE-2026-90951

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someo

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.

References

https://wpscan.com/vulnerability/bf740af6-3674-461e-83f0-22bd5c5b3378/

Published: 2026-09-23 · Source: NVD · Feed updated: 2026-09-23

This unknown severity vulnerability was published on 2026-09-23 via NVD.

vulnfeed aggregates 4195 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.