The vulnerability lies in the process_payment function of the Paid Membership Subscriptions plugin. A missing capability check allows an unauthenticated user to invoke the AJAX checkout handler and trigger a stored payment to renew a member's subscription. This results in an unauthorized charge being processed, potentially causing financial loss for the site owner.

All installations of the CozmosLabs Paid Membership Subscriptions plugin that are using version 2.16.4 or any earlier version are affected. No further sub‑version details are specified, so the vulnerability is believed to be present across all releases up to and including 2.16.4.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The flaw allows an attacker to send a crafted HTTP request to the AJAX endpoint without authentication, which can trigger a member renewal. Because the endpoint processes payments automatically, the impact on merchants depends on the number of active subscriptions and the ease with which an attacker can identify member identifiers. The vulnerability is not listed in the CISA KEV catalog.