CyberRota Analysis
AI-GeneratedThe Paid Membership Subscriptions plugin for WordPress prior to version 3.0.7 is vulnerable due to a lack of capability and nonce checks on a payment-related AJAX action, enabling authenticated users with Subscriber-level access or higher to access and disclose the payment details of any member by enumerating payment identifiers. This vulnerability could lead to unauthorized exposure of sensitive financial information. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of data leakage.
Original NVD Description
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.