The Paid Membership Subscriptions plugin for WordPress, versions up to and including 2.13.4, contains a sensitive information exposure vulnerability (CWE-200). This vulnerability arises because the plugin does not properly restrict access to content filtered by the WordPress core search feature, enabling unauthenticated users to retrieve data from posts restricted to higher-level roles such as logged-in users. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to confidentiality loss.

An unauthenticated attacker can extract sensitive data from restricted posts intended only for logged-in users or higher-level roles. This exposure compromises confidentiality but does not affect data integrity or system availability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting or disabling the WordPress core search feature for sensitive content or applying custom access controls to prevent unauthorized data exposure via search queries.