Description
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Paid Membership Subscriptions | 2.0.5 – < 3.1.0 | 3.1.0 |
References
- https://wpscan.com/vulnerability/685f381e-97b5-4855-a0ca-5854043a7b9e/ exploit vdb-entry technical-description