PT-2026-36609 · WordPress · Paid Memberships Pro

Jared Reyes · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-4100

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro versions prior to 3.6.6

Description The Paid Memberships Pro plugin for WordPress allows authenticated attackers with Subscriber-level access or higher to modify or disrupt Stripe webhook configurations. This is caused by missing capability checks in the AJAX handlers wp ajax pmpro stripe create webhook(), wp ajax pmpro stripe delete webhook(), and wp ajax pmpro stripe rebuild webhook(). Exploitation can lead to the deletion, creation, or rebuilding of the site's Stripe webhook, which disrupts payment processing, subscription renewal synchronization, cancellation handling, and failed payment management.

Recommendations Update to a version later than 3.6.5. As a temporary workaround, restrict access to the wp ajax pmpro stripe create webhook(), wp ajax pmpro stripe delete webhook(), and wp ajax pmpro stripe rebuild webhook() handlers.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4100

Affected Products

Paid Memberships Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-4100 · Security Note
• https://github.com/strangerstudios/paid-memberships-pro/pull/3615 · Note
• https://t.me/cveNotify/161870 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2050589242292584829 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5b333a3d-e416-42aa-9722-5406df0a64b3?source=cve · Note
• https://t.me/CVEtracker/52525 · Telegram Post