The vulnerability is an unauthenticated CSRF flaw that allows an attacker to trick a site visitor into performing administrative actions—specifically, adding a new membership member—through the Paid Memberships Pro - Add Member From Admin plugin. This weakness aligns with CWE‑352 and carries a CVSS score of 8.8, indicating a high severity impact on confidentiality, integrity, and availability. An attacker who succeeds can expand user privileges, create rogue accounts, or otherwise manipulate membership data without user authentication.

WordPress sites that have the Stranger Studios Paid Memberships Pro - Add Member From Admin plugin at versions 0.7.2 or earlier are affected. Users of these older plugin releases should review their version numbers and upgrade accordingly.

With no EPSS data available, the exact likelihood of exploitation remains uncertain, but the high CVSS score and known CSRF nature suggest the risk is non-trivial. The vulnerability is not listed in the CISA KEV catalog, indicating no documented large-scale exploitation yet. The attack vector is inferred to be a user visiting a crafted link or page that submits a request—given the unauthenticated nature of the flaw—so any web user could be a target.