The vulnerability in the Paid Membership Subscriptions WordPress plugin, a CWE‑693 protection mechanism failure, allows an unauthenticated user to bypass the reCAPTCHA challenge during registration when a form field is omitted from the request. This omission prevents the plugin from verifying the reCAPTCHA token, enabling attackers to create new user accounts without solving the challenge. The result is an elevation of privilege that can be exploited for spam, credential stuffing, or further malicious activity on the site.

WordPress sites that have the Paid Membership Subscriptions plugin installed at a version earlier than 3.1.0 are affected. The plugin’s registration component does not enforce the reCAPTCHA verification for all input fields, exposing sites that rely on this plugin for user management.

The CVSS score of 5.3 indicates moderate risk; the EPSS score is not reported, and the vulnerability is not in the CISA KEV catalog. Attackers can exploit the flaw by submitting crafted registration requests that omit required form fields, a straightforward action that requires no special credentials or tools. Because the vector is remote and requires only web traffic, the likelihood of exploitation is high on unpatched installations.