Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-68514 EUVD-2025-208075GHSA-4ggr-f4xw-9446

WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability

Published Feb 20, 2026 · Updated Apr 29, 2026 · Assigned by Patchstack

Description

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.16.8.

Affected products

VendorProductAffectedFixed
Cozmoslabs Paid Member Subscriptions ≤ 2.16.8 —

References