The vulnerability is an Insecure Direct Object Reference that allows a user to modify request parameters to reference subscriber objects outside their authorization scope, potentially revealing sensitive subscription information. It is an instance of CWE‑639, indicating an access control breach.

The issue affects the Paid Member Subscriptions plugin from Cozmoslabs for WordPress, specifically versions 3.0.7 and all earlier releases. Any WordPress site that has installed these plugin versions is vulnerable.

The CVSS score of 7.5 classifies the flaw as high severity. The EPSS score of less than 1% indicates low but non‑zero probability of exploitation in the general public. The vulnerability is not listed in CISA’s KEV catalog, implying limited evidence of exploitation. Based on the IDOR nature, the likely attack vector involves crafted URLs or API requests that include subscriber identifiers, a method inferred from the described weakness. Mitigation requires applying the vendor‑supplied patch that enforces proper access controls.