CVE-2026-4100: 
WordPress vulnerability analysis and mitigation

CVE-2026-4100 is a Missing Authorization vulnerability in the Paid Memberships Pro plugin for WordPress that allows authenticated attackers with Subscriber-level access or above to unauthorized modify the site's Stripe webhook configuration. It affects all versions of the plugin up to and including 3.6.5. The vulnerability was published on May 2, 2026, and assigned a CVSS v3.1 base score of 7.1 (High) (Github Advisory, Wordfence).

The root cause is missing capability checks (CWE-862: Missing Authorization) on three WordPress AJAX handlers: wp_ajax_pmpro_stripe_create_webhook, wp_ajax_pmpro_stripe_delete_webhook, and wp_ajax_pmpro_stripe_rebuild_webhook. These handlers, registered in classes/gateways/class.pmprogateway_stripe.php, did not verify that the requesting user held the required PMPro payment settings capability or manage_options before executing privileged Stripe webhook operations. Additionally, no nonce-based CSRF protection was in place, meaning any authenticated WordPress user — even a basic Subscriber — could send crafted AJAX requests to manipulate the site's Stripe webhook configuration. The fix, merged in PR #3615 on March 13, 2026, added a centralized authorization and nonce validation helper applied to all three handlers (GitHub PR, Github Advisory).

Successful exploitation disrupts all Stripe-based payment processing on the affected WordPress site, including subscription renewal synchronization, cancellation handling, and failed payment management. An attacker can delete the existing webhook (severing Stripe event notifications), create a rogue webhook, or rebuild the configuration to an undesired state, effectively causing a denial of service for the site's e-commerce and membership functionality. There is no confidentiality impact (no data exposure), but integrity is partially affected (LOW) and availability is severely impacted (HIGH) (Github Advisory, Wordfence).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.036–0.047%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability requires only Subscriber-level authentication, which lowers the barrier for exploitation on sites with open user registration. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Github Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running Paid Memberships Pro version 3.6.5 or earlier with Stripe as the active payment gateway, using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Account Registration: Register a low-privilege account (Subscriber level) on the target WordPress site, or use an existing compromised Subscriber credential.
3. Identify AJAX Endpoint: Confirm the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) is accessible and determine the target action names (pmpro_stripe_delete_webhook, pmpro_stripe_create_webhook, or pmpro_stripe_rebuild_webhook).
4. Craft Malicious Request: Send an authenticated HTTP POST request to /wp-admin/admin-ajax.php with the action parameter set to the desired webhook operation (e.g., action=pmpro_stripe_delete_webhook), including the WordPress authentication cookies for the Subscriber account.
5. Disrupt Webhook: The server processes the request without capability or nonce validation, executing the webhook deletion, creation, or rebuild — severing or corrupting the site's Stripe event notification pipeline and disrupting all payment processing (Github Advisory, GitHub PR).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with action values of pmpro_stripe_delete_webhook, pmpro_stripe_create_webhook, or pmpro_stripe_rebuild_webhook originating from non-administrative user sessions.
• Logs: WordPress access logs showing repeated AJAX calls to the above actions from low-privilege user accounts (Subscriber role); Stripe dashboard logs showing unexpected webhook creation, deletion, or modification events not initiated by site administrators.
• Application Behavior: Sudden failure of Stripe payment processing, subscription renewals, or cancellation handling on a site running Paid Memberships Pro; Stripe webhook endpoint showing as missing or pointing to an unexpected URL in the Stripe dashboard.

Update the Paid Memberships Pro plugin to a version newer than 3.6.5, which includes the fix merged in PR #3615 (commit 8650b05) adding proper capability checks (manage_options or the PMPro payment settings capability) and nonce validation to all three Stripe webhook AJAX handlers. As an interim workaround, site administrators should disable open user registration if not required, and monitor the Stripe dashboard for unauthorized webhook changes. Reviewing and restricting Subscriber-level access on the WordPress site can also reduce the attack surface until the patch is applied (GitHub PR, Wordfence).

Wordfence included CVE-2026-4100 in their weekly WordPress vulnerability report for the period of April 27–May 3, 2026, noting it as part of a broader set of plugin vulnerabilities (Wordfence Blog). RedPacketSecurity shared the advisory on Mastodon, and the CVE received brief coverage on Bluesky via automated CVE notification accounts. Community reaction has been limited given the absence of a public exploit and the relatively narrow impact scope.