CVE-2026-90950: Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Paid Membership Subscriptions WordPress pluginto a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Paid Member Subscriptions versions before 3.1.0 are affected if they rely on the plugin's registration-form reCAPTCHA to prevent automated account creation.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They can submit a registration request with the relevant form field absent, causing the registration handler not to verify reCAPTCHA.
What is the practical impact?
An attacker can create accounts without completing the reCAPTCHA configured on the registration form. The provided impact is limited to confidentiality; no integrity or availability impact is specified.
How can I tell whether my site may already be affected?
Review whether Paid Member Subscriptions is below version 3.1.0 and whether its registration form has reCAPTCHA enabled. Also review newly created accounts for registrations that may have bypassed the expected reCAPTCHA challenge.