The Paid Memberships Pro plugin for WordPress contains missing capability checks on three AJAX handlers that manage Stripe webhook configuration. Because the checks are omitted, any authenticated user with Subscriber‑level access or higher can delete, create, or rebuild the Stripe webhook. This enables an attacker to disable payment processing, subscription renewal, cancellation handling, and failed‑payment notifications, effectively disrupting the site’s monetary transactions. The vulnerability is reported with a CVSS score of 7.1, which indicates a considerable risk to the integrity and availability of the payment workflow.

All installations of Paid Memberships Pro for WordPress version 3.6.5 or older are affected. The plugin is maintained by Stranger Studios and is used for content restriction, user registration, and paid subscriptions. Versions after 3.6.5 are not impacted, but it is unclear from the data whether higher releases exist.

The vulnerability can be exploited only by users who are already authenticated and possess at least Subscriber privileges, a role that typically is assigned to ordinary site members. Because the flaw provides no network‑level entry vector and EPSS data is unavailable, the likelihood of exploitation depends on the site exposing the WordPress AJAX admin route and the presence of a vulnerable user. The CVSS score of 7.1 reflects the medium severity, and the lack of listing in the CISA KEV catalog indicates there is no publicly known exploit at the time of analysis.