CVE-2026-90922
Last modified
CVE-2026-90922 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount..
Description
The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Paid Membership Subscriptions | < 3.0.9 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-90922?
How severe is CVE-2026-90922?
How do I fix CVE-2026-90922?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-90917Joomla! Core - [20260907] - Core - Improper ACL checks in ou…5.3
- CVE-2026-90918Joomla! Core - [20260908] - Core - XSS in HTML Mail Template…5.3
- CVE-2026-90919LightLLM through 1.2.0 contains a remote code execution vuln…9.8
- CVE-2026-9092Casdoor versions 2.362.0 and earlier contain a vulnerability…9.1
- CVE-2026-90920IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote …9.8
- CVE-2026-90921IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote …7.5
- CVE-2026-90923The Autopay WordPress plugin before 5.0.1 does not enforce t…6.5
- CVE-2026-90924Use of default credentials vulnerability in Innotim Software…9.8
- CVE-2026-90925Improper Limitation of a Pathname to a Restricted Directory …7.1
- CVE-2026-90926Improper Control of Generation of Code ('Code Injection') vu…8.8
- CVE-2026-90927filebrowser through 2.63.23 fails to limit WebSocket message…6.5
- CVE-2026-90928File Browser through 2.63.23 contains a memory exhaustion vu…6.5
Are you affected by CVE-2026-90922?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST