An authorization vulnerability in the Paid Memberships Pro plugin for WordPress allows authenticated attackers with Subscriber-level access or higher to manipulate Stripe webhooks, resulting in payment processing failures and subscription disruptions.

This is a missing authorization flaw caused by absent capability checks on the wp_ajax_pmpro_stripe_create_webhook, wp_ajax_pmpro_stripe_delete_webhook, and wp_ajax_pmpro_stripe_rebuild_webhook AJAX handlers, requiring low-privileged authenticated access by subscribers.

A successful exploit allows attackers to delete, create, or rebuild Stripe webhooks, immediately halting payment processing, subscription renewals, cancellation handling, and failed payment management. This disruption can cause direct financial loss and severe reputational damage. The CVSS score of 7.1 highlights a high severity risk due to the potential for significant operational impact.

Immediate Action: Review vendor advisories for the release of a patched version of Paid Memberships Pro and update the plugin immediately.

Proactive Monitoring: Monitor WordPress activity logs and payment gateway error logs for unexpected changes or failures in Stripe webhook events.

Compensating Controls: Restrict access to WordPress AJAX endpoints using a Web Application Firewall or restrict user registration privileges to prevent untrusted users from acquiring Subscriber access.

Public Exploit Available: false

Organizations utilizing the Paid Memberships Pro plugin must treat this vulnerability with high urgency given its potential to disrupt core business revenue streams. Administrators should monitor the vendor repository for the official patch and apply the update as soon as it becomes available while auditing current user roles and permissions.