Paid Membership Subscriptions

Paid Membership Subscriptions before 3.0.8 changes a subscription through its checkout flow without verifying that the targeted subscription belongs to the current user. A Subscriber can supply another member's subscription identifier and overwrite its plan, status and expiration. The public advisory does not disclose the checkout endpoint, identifier parameter, update fields or ownership-check function.

Paid Membership Subscriptions before 3.0.7 writes member and payment export artifacts to a predictable location beneath the public uploads directory without access protection. While an export artifact exists, an unauthenticated visitor who requests its predictable URL can download member and payment data, including personally identifiable information. The published record does not disclose the exact directory, filename pattern, export action or cleanup interval.

Paid Membership Subscriptions before 3.0.7 exposes a payment-related AJAX action without a capability or nonce check. Any authenticated Subscriber-or-higher user can enumerate payment identifiers and request payment details belonging to other members. The published record does not identify the AJAX action, payment-ID parameter, callback function or the exact payment fields returned.