CVE-2026-10820: WordPress Paid Membership Plugin Authorization Bypass Allows Subscription Cancellation

Technical summary

CVE-2026-10820 is an authorization bypass vulnerability in the Paid Membership Plugin affecting versions before 4.16.17. The plugin implements subscription cancellation functionality but does not properly validate that the authenticated user owns the subscription object being modified. An attacker with basic subscriber-level privileges can directly reference and cancel arbitrary subscription IDs, resulting in unauthorized modification of subscription state. The vulnerability requires only network access and valid authentication credentials—no clickjacking, CSRF tokens, or special conditions are needed. The attack surface is the subscription management endpoint(s) exposed to all authenticated users.

Business impact

Organizations running vulnerable versions face immediate revenue impact through involuntary subscription cancellations. Competitors or malicious actors can systematically disable paying customers' subscriptions, causing service interruption and customer churn. The damage extends beyond lost recurring revenue to reputation harm, support burden from confused customers, and potential chargebacks. SaaS and membership-based business models are especially vulnerable. Incident response will require database forensics to identify canceled subscriptions, manual restoration, and customer communication—activities that scale poorly with subscriber count.

Affected systems

The Paid Membership Plugin (covering ecommerce, user registration, login forms, user profiles, and content restriction) in all versions prior to 4.16.17 is affected. Any WordPress site running an older version with active subscription functionality is exposed. Impact is highest on sites allowing user self-service subscription management and those with high subscription churn expectations. Plugin usage statistics should be checked in public WordPress repositories to gauge exposure scope.

Exploitability

This vulnerability is trivial to exploit. An attacker needs only a valid WordPress account at the subscriber level or higher—credentials that are often freely available through registration forms. No special tools beyond a standard HTTP client (curl, browser developer tools) are required to craft requests targeting other users' subscriptions. The attack leaves minimal forensic traces if logging is not explicitly enabled. The low barrier to entry and deterministic impact make this highly exploitable in practice.

Remediation

Update the Paid Membership Plugin to version 4.16.17 or later immediately. The patch adds proper ownership verification before processing subscription cancellations, ensuring authenticated users can only modify their own subscriptions. Verify the update is applied across all WordPress instances running the plugin. As an interim control while patching is in progress, restrict access to membership management pages to trusted administrators and disable user self-service subscription cancellation if the plugin permits it.

Patch guidance

Apply the update to version 4.16.17 or newer through the WordPress admin dashboard (Plugins → Updates) or via command line using WP-CLI. Test the update in a staging environment first to confirm compatibility with custom code or dependent plugins. After patching, verify that subscription cancellation requests are properly restricted to the subscription owner. Confirm plugin activation status and check for any hooks or integrations that may have been affected by the patch.

Detection guidance

Monitor web server logs for repeated requests to subscription management endpoints from a single user account across multiple subscription IDs. Look for POST or GET requests containing subscription identifiers that don't match the authenticated user's profile. Database audit logs should show subscription records being modified by users who don't own them. Configure WordPress activity logging plugins to capture subscription state changes and cross-reference with user accounts. Search for any access patterns suggesting systematic enumeration or cancellation of subscription IDs.

Why prioritize this

This is a HIGH severity vulnerability (CVSS 8.1) combining authentication-bypass conditions with direct business impact. The attack requires minimal sophistication, affects a popular plugin in an active and critical part of WordPress site operations, and causes immediate, visible harm to revenue and customer experience. Organizations with subscription models should treat this as a critical/urgent patch priority. The IDOR class of vulnerability is well-understood and frequently weaponized in production attacks.

Risk score, explained

The CVSS 8.1 score reflects a network-accessible vulnerability exploitable by low-privileged attackers with no user interaction required. The attack has high integrity impact (ability to modify subscriptions) and high availability impact (service denial to other users), but no confidentiality loss. The attack vector is network-based with low complexity, and no special conditions must be met beyond valid authentication. The Integrity and Availability impacts are scored as HIGH because subscription cancellation is a core business function; the damage is material and directly observable.

Frequently asked questions