CVE-2026-10820 is an authorization bypass vulnerability (CWE-639) in the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin. The flaw exists because the plugin fails to verify that the user performing a subscription action owns the targeted subscription. As a result, any authenticated user with at least Subscriber privileges can cancel active subscriptions belonging to other users by exploiting an insecure direct object reference. This vulnerability affects versions prior to 4.16.17. No official patch or remediation level has been confirmed in the provided data.

The vulnerability allows an authenticated user to cancel other users' active subscriptions without authorization. This can disrupt legitimate users' access to paid content or services, causing denial of service and potential revenue loss for the site owner. The CVSS score of 8.1 reflects high impact due to the integrity and availability consequences, though confidentiality is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to limit who can perform subscription actions, and monitor for suspicious subscription cancellations. Avoid granting Subscriber+ roles to untrusted users. Review plugin updates regularly for a security patch addressing this issue.