CVE-2026-14848 is an improper access control vulnerability (CWE-284) in the Paid Membership Subscriptions WordPress plugin prior to version 3.0.8. The plugin fails to verify ownership of the subscription being modified through the change-subscription checkout functionality. Consequently, authenticated users with at least Subscriber-level privileges can overwrite another member's subscription details, including plan, status, and expiration, effectively hijacking the subscription.

An attacker with Subscriber-level or higher authenticated access can take over other users' subscriptions by modifying their subscription plans, statuses, and expiration dates. This could lead to unauthorized access to paid content or services, subscription fraud, and potential financial loss for the service provider.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for suspicious subscription modifications. Avoid granting unnecessary privileges to users and consider additional access control measures to prevent unauthorized subscription changes.