CyberRota Analysis
AI-GeneratedThe Paid Membership Subscriptions plugin for WordPress prior to version 3.0.8 is vulnerable as it fails to verify ownership of subscriptions during modifications, allowing authenticated users with Subscriber-level access or higher to manipulate other users' subscriptions. This can lead to unauthorized changes in subscription plans, statuses, and expirations, potentially impacting user trust and revenue. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.