Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions vulnerabilities

2 known vulnerabilities in Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions from Strangerstudios. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  Paid Memberships Pro – Content Restriction…: Missing Authorization

  CVE-2026-4100May 2, 2026Strangerstudios

  The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the `wp_ajax_pmpro_stripe_create_we

• 8.8 High severity

  Paid Memberships Pro – Content Restriction…: Unrestricted Upload of File with Dangerous Type

  CVE-2023-6187Nov 18, 2023StrangerstudiosEPSS 51.3%

  The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible f