Security Alert Summary
The Paid Membership Subscriptions WordPress plugin contains a vulnerability that can allow unauthenticated users to create accounts without completing the site's enabled reCAPTCHA. The registration handler fails to verify reCAPTCHA when an expected form field is missing from the request, enabling account creation bypass on affected versions.
CVE Details
- CVE ID:
CVE-2026-90950 - Affected plugin / component: Paid Membership Subscriptions (registration handler)
- Affected versions: Versions less than 3.1.0 (example listed: 2.0.5)
- Published: September 23, 2026 at 11:17:16 AM
- Last modified: September 23, 2026 at 11:17:16 AM
- CVSS v3.1: Base score 5.3, MEDIUM; vector string:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction: Authentication not required; privileges required: NONE; user interaction: NONE
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- CWE / weakness: CWE-693
Technical Details
The plugin's registration handler does not verify the configured reCAPTCHA when a specific form field is absent from the incoming request. As described in the advisory, this missing-field condition bypasses the reCAPTCHA check and allows unauthenticated users to create accounts without solving the captcha the site has enabled.
No specific functions or endpoints are named in the provided data; the issue is described as a missing verification step in the registration processing logic. The measurable impact is limited to the ability to create accounts without passing reCAPTCHA; integrity and availability impacts are not indicated by the CVSS data.
How This Could Impact Your Website
In a typical small-to-medium WordPress site, this vulnerability could let an external actor create multiple user accounts without solving the site's reCAPTCHA. That increases the likelihood of spam accounts appearing in user listings and may expose internal email addresses or names visible to other users or staff.
For example, an attacker could register accounts that appear to be contributors or subscribers and then use those accounts to send targeted messages or reconnaissance that enables phishing or social engineering against site owners, editors, or contractors. The direct technical impact reported is limited to confidentiality (low) rather than site-wide takeover, but these accounts can still be used for nuisance or targeted social attacks.
If you're unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor or editor roles for unknown accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and new account registrations for unusual behavior or spikes in signups.
If you'd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
