low3.7
CVE-2026-14849
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the…
Impact
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.
Affected products
| Product | Affected versions |
|---|---|
| Paid Membership Subscriptions WordPress Plugin | before 3.0.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.