CVE-2026-107434: WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability

Q: What level of access does an attacker need?

An attacker needs low-level authenticated access, such as a Subscriber account. The issue is reachable over the network and does not require user interaction.

Q: What is the potential impact of successful exploitation?

Successful exploitation may affect integrity and availability. No confidentiality impact is indicated.

Q: How can I determine whether my site is affected?

Check whether the WordPress MicroPayments plugin is installed and identify its version. Versions 3.2.9 and earlier are identified as affected.

Published Oct 10, 2026

Updated

Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.

Affected Software

1 affected component

WordPress MicroPayments plugin<=3.2.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress MicroPayments – Fans Paysite / Paid Membership to a version that resolves this vulnerability.
Fixed in 3.2.10

Event History

Oct 10, 2026

CVE Published

via MITRE·07:36 PM

Data Sourced

via MITRE·07:36 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

An attacker needs low-level authenticated access, such as a Subscriber account. The issue is reachable over the network and does not require user interaction.

What is the potential impact of successful exploitation?