The vulnerability is a missing authorization flaw in the Paid Member Subscriptions plugin for WordPress that allows an attacker to exploit incorrectly configured access control security levels. This flaw enables users without proper role permissions to perform privileged actions within the plugin, such as modifying subscription plans or accessing restricted content. The weakness is categorized as CWE‑862, reflecting incorrect or missing authorization checks.

Affects installations of the paid-member-subscriptions plugin version 3.1.2 and earlier, including any build from the initial release through 3.1.2. The affected product is "Paid Member Subscriptions" by Cozmoslabs, used as a WordPress plugin.

The CVSS score of 6.5 indicates a moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Because the issue resides in a WordPress plugin exposed over the web, the likely attack vector is through the public-facing site, potentially allowing an unauthenticated or low-privileged user to trigger the privileged actions. The exploit does not require prior authentication, so an attacker can target any site running an affected version of the plugin.