CVE-2026-90950: Unknown Paid Membership Subscriptions

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.

Affected products

• Unknown Paid Membership Subscriptions: from 2.0.5, before 3.1.0 (fixed in 3.1.0)

Published 2026-09-23. Last modified 2026-09-23.