This vulnerability originates from a missing authorization check in the Cozmoslabs Paid Member Subscriptions plugin. The flaw permits users to exploit incorrectly configured access control security levels, enabling them to reach areas or alter data that should be restricted. The primary impact is the potential to obtain or modify subscription information and related management functions, compromising the confidentiality and integrity of subscription data.

The affected product is the Paid Member Subscriptions WordPress plugin developed by Cozmoslabs. Versions from the earliest released through version 2.15.9 are vulnerable.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is deduced to involve standard web requests to the plugin’s administrative endpoints, taking advantage of the broken authorization logic. An attacker with access to the site can exploit the flaw by sending crafted HTTP requests that bypass normal authentication checks and access protected subscription resources.