CVE-2026-10820 Details

A vulnerability exists in the Paid Membership WordPress plugin, specifically in versions prior to 4.16.17. The plugin fails to ensure that users canceling subscriptions actually own the subscriptions they are targeting. This flaw allows any authenticated user with a Subscriber role or higher to cancel active subscriptions of other users, exploiting an Insecure Direct Object Reference. In cases involving lifetime plans, the victim's WordPress role is also revoked. Furthermore, if a payment gateway is linked, the cancellation is communicated to the gateway, complicating the reversal of the action. Subscription IDs are sequential, enabling an attacker to systematically cancel all active subscriptions on the site.