The Paid Memberships Pro WordPress plugin up to version 2.12.10 is vulnerable to CSRF due to missing or incorrect nonce validation on multiple functions. This flaw enables attackers to craft malicious requests that, when executed by authenticated users, can alter membership subscriptions without their consent. The vulnerability affects membership subscription management features, potentially allowing unauthorized subscription changes. The CVSS 3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No known exploits in the wild or official patches are currently documented.

An attacker can exploit this vulnerability to cause authenticated users to unknowingly subscribe to, modify, or cancel their memberships by tricking them into clicking malicious links. This can lead to unauthorized changes in membership status, potentially affecting user access and subscription billing. There is no direct confidentiality impact, but integrity and availability impacts are low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted links and consider disabling or restricting the plugin's membership management features if feasible. Monitor the vendor's website or plugin repository for updates addressing this CSRF vulnerability.