CVE-2026-14849CWE-552

CVE-2026-14849

Low · published July 31, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-07-31T11:16Z
References (1)
https://wpscan.com/vulnerability/306a498d-0740-479b-b182-71fc3d7452bb/ · [email protected]
EPSS history
Timeline
  • 31 JUL 06:00Z
    Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files
    cvelistv5