CVE-2025-68514: 
WordPress vulnerability analysis and mitigation

CVE-2025-68514 is an Insecure Direct Object Reference (IDOR) / Authorization Bypass Through User-Controlled Key vulnerability in the Cozmoslabs Paid Member Subscriptions WordPress plugin. It affects all versions up to and including 2.16.8, and was reported on November 29, 2025, with public disclosure on February 11, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Feedly).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), manifesting as an Insecure Direct Object Reference (IDOR) flaw. An authenticated attacker with at least Subscriber-level privileges can manipulate user-controlled keys or object identifiers in requests to bypass authorization checks, potentially accessing or modifying resources they should not have permission to interact with. The attack is network-based, requires low privileges, and no user interaction, making it straightforward to exploit once an attacker has a basic account on the target WordPress site (Patchstack).

Successful exploitation can result in a high integrity impact, allowing an authenticated low-privileged attacker to bypass authorization controls and interact with objects (such as subscription records or database entries) belonging to other users. There is no direct confidentiality or availability impact per the CVSS scoring, but the ability to manipulate subscription data could allow privilege escalation within the plugin's access control model or unauthorized modification of membership records. The scope is limited to the affected WordPress installation (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is very low at approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability requires at least Subscriber-level authentication, which limits the attacker pool. Patchstack classifies this as low priority with unlikely exploitation impact, though they note that IDOR-class vulnerabilities can be used in mass-exploit campaigns targeting WordPress sites (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the Paid Member Subscriptions plugin version 2.16.8 or earlier using tools like WPScan or Shodan.
2. Obtain low-privilege access: Register or log in as a Subscriber-level user on the target WordPress site.
3. Identify object references: Interact with the plugin's subscription management features and observe the object identifiers (e.g., subscription IDs, user IDs) used in HTTP requests.
4. Manipulate object keys: Modify the user-controlled key parameters in requests (e.g., changing a subscription ID to that of another user) to reference objects belonging to other accounts.
5. Bypass authorization: Due to insufficient server-side authorization checks, the plugin processes the manipulated request, allowing the attacker to view or modify subscription records or other plugin-managed data belonging to other users (Patchstack).

• Logs: WordPress access logs showing authenticated requests (with valid session cookies) to Paid Member Subscriptions plugin endpoints where the object ID parameters differ from those associated with the authenticated user's account.
• Logs: Repeated or sequential enumeration of subscription or user IDs in plugin-related POST/GET requests from a single authenticated session.
• Network: Unusual patterns of requests to plugin-specific URLs (e.g., /wp-admin/admin-ajax.php or plugin front-end endpoints) with incrementing or out-of-range ID values from a single low-privilege user.

The vulnerability is patched in Paid Member Subscriptions version 2.16.9. Site administrators should update the plugin to version 2.16.9 or later immediately. If an immediate update is not possible, consider restricting new subscriber registrations or contacting your hosting provider for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).