CVE-2026-4100

HIGH

Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-4100 has a selected CVSS score of 7.1 (high).

Description

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the `wp_ajax_pmpro_stripe_create_webhook`, `wp_ajax_pmpro_stripe_delete_webhook`, and `wp_ajax_pmpro_stripe_rebuild_webhook` AJAX handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete, create, or rebuild the site's Stripe webhook, disrupting all payment processing, subscription renewal synchronization, cancellation handling, and failed payment management.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 4, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions

Browse strangerstudios / Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions

Default status: unaffected

CVE ListThrough 3.6.5affected

References

3