CVE-2026-14849
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Paid Membership Subscriptions WordPress plugin before version 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory. Unauthenticated users can download these files, containing personal data (PII), while an export artifact is present.
Risk Assessment
Leakage of member personal data and payment details occurs, potentially violating privacy and leading to legal consequences.
Recommendation
Update the Paid Membership Subscriptions plugin to version 3.0.7 or later, which secures export files against unauthorized access.
Original NVD description (English source)
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.