The vulnerability is found in Paid Membership Subscriptions plugin versions earlier than 3.1.0. The pms_process_payment function does not bind its unauthenticated payment actions to the requesting user. This means a user who discovers another member’s in‑flight payment identifier can use the payment endpoint to delete that member’s checkout state. The resulting effect is that the identified member’s pending transaction is removed, which can disrupt the purchase flow or terminate a legitimate payment.

Any WordPress website running Paid Membership Subscriptions before version 3.1.0 is affected. The plugin is a commercial membership management tool, and the vulnerability only touches the payment module; other features of the plugin are not impacted. There is no specific manufacturer name other than the generic plugin id.

The CVSS score of 3.7 indicates moderate impact. The EPSS score of less than 1% implies the likelihood of exploitation is very low, and the vulnerability is not listed in CISA KEV. The most likely attack vector is a remote, unauthenticated HTTP request to the pms_process_payment action, provided an attacker can obtain a valid in‑flight payment ID. Overall the risk is limited but should still be mitigated.