CVE-2026-14849 — Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads director…
Published: 2026-07-31 · CVSS: 3.7 · CVSS 3.1
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7