CVE-2025-68514 describes an authorization bypass vulnerability in Cozmoslabs Paid Member Subscriptions plugin versions up to 2.16.8. The vulnerability is due to incorrectly configured access control security levels that allow exploitation via a user-controlled key. An attacker with low privileges can bypass intended authorization controls, potentially leading to unauthorized data modification. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official fix information is currently available.

The vulnerability allows an attacker with low privileges to bypass authorization controls, leading to unauthorized modification of data within the Paid Member Subscriptions plugin. There is no impact on confidentiality or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, users should monitor Cozmoslabs advisories for an official fix and apply updates promptly once available. Until a patch is released, consider restricting access to the plugin features to trusted users only to reduce risk.