The Paid Membership Subscriptions WordPress plugin before version 3.0.7 writes member and payment export files to a predictable location within the uploads directory without enforcing access controls, allowing any unauthenticated user to download these files while they exist. This vulnerability enables an attacker to obtain personally identifiable information (PII) and payment data, leading to potential privacy violations, fraud, or further exploitation. The weakness is improper file permissions (CWE-552).

This issue affects the Paid Membership Subscriptions plugin for WordPress. Clients using any version earlier than 3.0.7 are vulnerable. The affected vendor is not identified in the CNA data; however, the plugin name and version constraints are clear.

The vulnerability is exploitable over the web by simply requesting the export file’s URL, which does not require authentication or privileged access. EPSS score of <1% indicates a very low probability of exploit at this time, and the issue is not listed in the CISA KEV catalog. Nevertheless, the potential impact of exposing PII is significant, and the straightforward attack vector makes it a high‑value target for adversaries. Upgrading to the fixed version mitigates the risk entirely.