CVE-2026-4100 is a missing authorization vulnerability (CWE-862) in the Paid Memberships Pro plugin for WordPress, affecting all versions up to 3.6.5. The issue arises from the lack of capability checks on the AJAX handlers responsible for creating, deleting, and rebuilding Stripe webhooks (`wp_ajax_pmpro_stripe_create_webhook`, `wp_ajax_pmpro_stripe_delete_webhook`, and `wp_ajax_pmpro_stripe_rebuild_webhook`). As a result, authenticated users with minimal privileges (Subscriber-level and above) can manipulate the Stripe webhook configuration, potentially disrupting payment processing, subscription renewals, cancellations, and failed payment handling.

The vulnerability allows authenticated users with low privileges to interfere with Stripe webhook configurations, leading to disruption of payment processing and subscription management functions. While it does not expose sensitive data or allow privilege escalation, the impact includes denial of service to critical payment workflows, which can affect revenue and user experience.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user capabilities where possible and monitor for unauthorized changes to Stripe webhook configurations. Avoid granting unnecessary privileges to low-level authenticated users. Follow updates from the vendor for an official patch or temporary mitigation.