CVE-2026-57659: Unauthenticated CSRF in Paid Memberships Pro – Admin Member Manipulation

Technical summary

CVE-2026-57659 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Member From Admin' functionality of Paid Memberships Pro up to version 0.7.2. The plugin fails to implement or validate nonce tokens on the member creation endpoint, allowing attackers to forge requests that execute with the privileges of any authenticated administrator. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and carries a CVSS 3.1 score of 8.8 (HIGH), indicating high impact across confidentiality, integrity, and availability.

Business impact

An attacker exploiting this vulnerability could create unauthorized admin accounts, escalate privileges, modify or delete paying members, disrupt subscription billing, or lock legitimate administrators out of the system. For organizations relying on Paid Memberships Pro for membership management and revenue, this attack directly threatens operational integrity and customer trust. Unauthorized account modifications could also trigger compliance issues if member data is altered without audit trails.

Affected systems

Paid Memberships Pro version 0.7.2 and all earlier versions are affected. The vulnerability specifically impacts the admin member-addition feature. Any WordPress installation running this plugin version is at risk if administrators visit untrusted links or emails while logged into the admin dashboard.

Exploitability

The vulnerability is trivial to exploit. An attacker needs only to craft a web page containing a hidden form or JavaScript that submits a request to the plugin's member-creation endpoint. No authentication is required from the attacker, and only user interaction (visiting a link) is needed. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) reflects network accessibility, low complexity, and reliance on user click-through—all characteristics that make CSRF vulnerabilities practical to weaponize at scale.

Remediation

Update Paid Memberships Pro to a patched version released after June 26, 2026. Verify against the official Paid Memberships Pro security advisory or plugin repository for the recommended minimum version. If an immediate patch is not available, implement WordPress security hardening: enforce nonce validation on all admin forms, use WordPress's wp_verify_nonce() function, and educate administrators to avoid clicking links in unsolicited emails while logged into WordPress.

Patch guidance

Contact the Paid Memberships Pro development team or check the official WordPress plugin repository and vendor advisory for patch availability. Verify the release notes to confirm CSRF protections have been implemented. Test the patch in a staging environment before deploying to production, and monitor admin action logs for unauthorized member changes that may have occurred during the vulnerability window.

Detection guidance

Review WordPress admin audit logs for unexpected member creation or modification events, particularly those lacking corresponding user session context or initiated outside normal business hours. Monitor for admin action hooks on member add/edit functions. Implement network-level detection by flagging cross-origin POST requests to admin endpoints. Search security logs for requests originating from external referrers to wp-admin paths. Enable WordPress debug logging if supported to capture nonce validation failures.

Why prioritize this

This vulnerability should be prioritized as HIGH. It requires no authentication or technical sophistication to exploit, affects a data-critical plugin feature, and has immediate business impact. The ability to silently create admin accounts or modify member records without leaving obvious traces makes it attractive to attackers. Even though it requires user interaction, CSRF attacks scale well through phishing campaigns and are proven attack vectors in the wild.

Risk score, explained

The CVSS 8.8 score reflects: network-based attack vector (no special access required), low complexity (standard CSRF), unauthenticated attacker (PR:N), user interaction as the only barrier (UI:R), and severe impact—confidentiality, integrity, and availability are all compromised if an admin's session is hijacked to perform account operations. The score accurately captures the severity for a WordPress admin-facing vulnerability.

Frequently asked questions