CVE-2026-14847 is an authorization bypass vulnerability in the Paid Membership Subscriptions WordPress plugin prior to version 3.0.7. The flaw arises from the lack of capability and nonce verification on a payment-related AJAX action, which allows authenticated users with Subscriber-level privileges or above to enumerate payment identifiers and access payment details of other members. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with authenticated Subscriber-level access or higher can disclose sensitive payment information of other members by exploiting the missing authorization checks. The vulnerability does not allow modification or denial of service but results in confidentiality loss of payment details. The CVSS score is 4.3 (medium severity), reflecting limited impact confined to information disclosure without integrity or availability effects.

No official fix or patch is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restricting Subscriber-level access and reviewing plugin usage policies may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.