CVE-2026-119523: WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability

Q: Which installations are affected?

Paid Member Subscriptions versions through 3.1.3 are affected. The available data does not identify a fixed version or any configuration prerequisites.

Q: What access does an attacker need to exploit this issue?

The available information identifies missing authorization and incorrectly configured access-control levels, but does not state whether authentication, a particular user role, or other preconditions are required.

Q: How can I determine whether my site is affected?

Check whether the Cozmoslabs Paid Member Subscriptions plugin is installed and whether its version is 3.1.3 or earlier. The provided data does not include affected endpoints, logs, or indicators of exploitation.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Paid Member Subscriptions to a version that resolves this vulnerability.
Fixed in 3.1.4

Event History

Nov 7, 2026

CVE Published

via MITRE·10:31 AM

Data Sourced

via MITRE·10:31 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Paid Member Subscriptions versions through 3.1.3 are affected. The available data does not identify a fixed version or any configuration prerequisites.

What access does an attacker need to exploit this issue?

The available information identifies missing authorization and incorrectly configured access-control levels, but does not state whether authentication, a particular user role, or other preconditions are required.

How can I determine whether my site is affected?

Check whether the Cozmoslabs Paid Member Subscriptions plugin is installed and whether its version is 3.1.3 or earlier. The provided data does not include affected endpoints, logs, or indicators of exploitation.