https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T17:20:19.310795+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-90951 fkie_cve-2026-90951 2026-10-02T17:20:20.111950+00:00

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.

 https://vulnerability.circl.lu/vuln/ghsa-rxfw-g454-gj22 GHSA-rxfw-g454-gj22 2026-10-02T17:20:20.112103+00:00

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.