CVE-2026-4100Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption
Updated under an hour ago ()
Does this affect you?
It affects strangerstudios Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the `wp_ajax_pmpro_stripe_create_webhook`, `wp_ajax_pmpro_stripe_delete_webhook`, and `wp_ajax_pmpro_stripe_rebuild_webhook` AJAX handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete, create, or rebuild the site's Stripe webhook, disrupting all payment processing, subscription renewal synchronization, cancellation handling, and failed payment management.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Wordfence
- NVD analysis
- Deferred
- Record last updated
- May 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
strangerstudios Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions strangerstudios:paid_memberships_pro_content_restriction_user_registration_and_paid_subscriptions (from the name) | through 3.6.5 | CNA record |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5b333a3d-e416-42aa-9722-5406df0a64b3?source=cve
- https://github.com/strangerstudios/paid-memberships-pro/pull/3615
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.