Vulnerability Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.
References
FAQ
What is CVE-2026-10820?
CVE-2026-10820 is a documented vulnerability. The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription acti...
How severe is CVE-2026-10820?
CVSS scoring is not yet available for CVE-2026-10820. Check NVD for updates.
Is there a patch for CVE-2026-10820?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.