The Paid Membership Subscriptions WordPress plugin up to version 2.13.7 contains an authentication bypass vulnerability (CWE-287) due to improper validation of the 'pms_payment_id' parameter in the pms_pb_payment_redirect_link function. This parameter, controlled by the user, is used to authenticate users without further checks, enabling attackers with knowledge of a valid payment ID to impersonate any purchaser on the site. The vulnerability is critical with a CVSS 3.1 score of 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently referenced, and no exploits are known in the wild.

Successful exploitation allows unauthenticated attackers to bypass authentication and log in as any user who has made a purchase, potentially exposing sensitive user data and enabling unauthorized actions with the privileges of the impersonated user. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress sites using this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict knowledge of valid payment IDs and monitor for suspicious login activity related to payment ID usage. Avoid exposing payment IDs in URLs or user-controllable parameters. Follow vendor updates closely for an official patch or mitigation instructions.