An IDOR vulnerability in the Cozmoslabs Paid Member Subscriptions plugin allows unauthenticated attackers to bypass authorization controls, posing a significant risk to data integrity.

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw, categorized as CWE-639. It occurs because the software fails to perform proper capability checks on user-controlled keys, allowing an unauthenticated attacker to perform unauthorized operations.

The ability for an unauthenticated user to manipulate objects through IDOR can lead to unauthorized modification of membership records or subscription data. With a CVSS score of 7.5, this high-severity flaw could result in significant business disruption, loss of revenue, and potential compromise of customer account integrity.

Immediate Action: Update the Paid Member Subscriptions plugin to version 3.0.8 or later to incorporate the necessary security patches.

Proactive Monitoring: Monitor server access logs for unusual patterns involving membership modification endpoints or unexpected POST requests from unauthenticated sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting plugin-specific parameters that facilitate object access.

Public Exploit Available: No

Given the high severity of this IDOR vulnerability, administrators must treat this as a priority update. Failure to patch allows unauthenticated actors to bypass access controls, potentially leading to unauthorized data manipulation. Apply the update to version 3.0.8 immediately to secure your WordPress environment.