Live › vulnerability › CVE-2026-112842
Go to dashboardThe Paid Member Subscriptions WordPress pluger by Cozmoslabs lacks an authorization check in one of its functions, so a user may reach functionality they should not. The sources do not say which action an attacker gains or what data is exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Paid Member Subscriptions plugin version 3.1.2 or earlier are listed as affected. The sources do not say which configurations or roles make a site more exposed.
No product ranges from the sources yet.
paid-member-subscriptions plugin in the WordPress admin under Plugins; versions through 3.1.2 are listed as affected.paid-member-subscriptions plugin to a version later than 3.1.2, per the vendor release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-112842")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.