CVE-2026-14849 describes a security weakness in the Paid Membership Subscriptions WordPress plugin versions prior to 3.0.7. The plugin fails to secure exported member and payment data files, which are stored in a predictable path within the uploads directory. Because these files are accessible without authentication, an attacker can download sensitive information including PII as long as the export files remain on the server. The vulnerability is categorized under CWE-552, indicating files or directories accessible to external parties. No official patch or remediation level is stated in the available data.

Exposure of exported member and payment data files to unauthenticated users can lead to unauthorized access to personally identifiable information (PII). The CVSS score of 3.7 (low severity) reflects limited impact, with confidentiality affected but no integrity or availability impact. The attack vector is network-based and requires no privileges or user interaction, but has high attack complexity due to the need to locate the predictable file path.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the uploads directory or exported files via web server configuration to prevent unauthorized downloads. Remove export artifacts promptly after use to minimize exposure.