CVE-2025-11835

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11835", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-15T21:48:26.282Z", "datePublished": "2025-11-05T03:27:57.526Z", "dateUpdated": "2026-04-08T17:31:09.651Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:09.651Z"}, "affected": [{"vendor": "cozmoslabs", "product": "Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.16.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to, and including, 2.16.4. This makes it possible for unauthenticated attackers to trigger stored auto-renew charges for arbitrary members."}], "title": "Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1948bd-c5b4-4fbe-9aa6-19f24325e6bb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3383182/paid-member-subscriptions"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-10-15T22:04:23.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-04T14:36:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T14:14:40.527293Z", "id": "CVE-2025-11835", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-07T14:26:27.092Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11835", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T14:14:40.527293Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T14:20:20.538Z"}}], "cna": {"title": "Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "cozmoslabs", "product": "Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.16.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-15T22:04:23.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-04T14:36:11.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1948bd-c5b4-4fbe-9aa6-19f24325e6bb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3383182/paid-member-subscriptions"}], "descriptions": [{"lang": "en", "value": "The Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to, and including, 2.16.4. This makes it possible for unauthenticated attackers to trigger stored auto-renew charges for arbitrary members."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:09.651Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11835", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:09.651Z", "dateReserved": "2025-10-15T21:48:26.282Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-05T03:27:57.526Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction", "vendor": "cozmoslabs", "versions": [{"lessThanOrEqual": "2.16.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to, and including, 2.16.4. This makes it possible for unauthenticated attackers to trigger stored auto-renew charges for arbitrary members."}, {"lang": "es", "value": "El plugin Paid Membership Subscriptions - Effortless Memberships, Recurring Payments & Content Restriction para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la ausencia de una verificaci\u00f3n de capacidad y validaci\u00f3n en la funci\u00f3n PMS_AJAX_Checkout_Handler::process_payment() en todas las versiones hasta, e incluyendo, la 2.16.4. Esto hace posible que atacantes no autenticados activen cargos de renovaci\u00f3n autom\u00e1tica almacenados para miembros arbitrarios."}], "id": "CVE-2025-11835", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11835", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-05T14:14:40.527293Z", "version": "2.0.3"}}]}, "published": "2025-11-05T04:15:32.063", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3383182/paid-member-subscriptions"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1948bd-c5b4-4fbe-9aa6-19f24325e6bb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:38:36.993488+00:00", "value": {"mitigation_remediation": ["Upgrade the Paid Membership Subscriptions plugin to a version newer than 2.16.4 when a vendor patch is released.", "If an update is not yet available, temporarily disable the auto\u2011renew feature or configure the AJAX checkout endpoint to require administrator authentication.", "Add server\u2011side capability verification before processing any auto\u2011renew transaction to ensure that only authorized users can trigger payments.", "Regularly review payment logs for unexpected renewal events and suspend any accounts involved in suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Auto-renew Charges"}, "threat_synthesis": {"affected_systems": "All installations of the CozmosLabs Paid Membership Subscriptions plugin that are using version 2.16.4 or any earlier version are affected. No further sub\u2011version details are specified, so the vulnerability is believed to be present across all releases up to and including 2.16.4.", "description_and_impact": "The vulnerability lies in the process_payment function of the Paid Membership Subscriptions plugin. A missing capability check allows an unauthenticated user to invoke the AJAX checkout handler and trigger a stored payment to renew a member's subscription. This results in an unauthorized charge being processed, potentially causing financial loss for the site owner.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The flaw allows an attacker to send a crafted HTTP request to the AJAX endpoint without authentication, which can trigger a member renewal. Because the endpoint processes payments automatically, the impact on merchants depends on the number of active subscriptions and the ease with which an attacker can identify member identifiers. The vulnerability is not listed in the CISA KEV catalog."}}}}, "created": "2025-11-05T10:47:02.431451+00:00", "updated": "2026-04-21T18:45:06.080519+00:00", "vendors": ["cozmoslabs", "cozmoslabs$PRODUCT$paid_membership_subscriptions", "wordpress", "wordpress$PRODUCT$wordpress"]}