The Paid Membership Plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) in the 'process_checkout' function. Specifically, when the 'change_plan_sub_id' parameter is supplied in a checkout request, the plugin fails to verify whether the referenced membership plan is active. As a result, authenticated users with Subscriber-level privileges or higher can subscribe to inactive membership plans by manipulating this parameter. This flaw exists in all versions up to and including 4.16.12. The CVSS v3.1 base score is 4.3, reflecting a low attack complexity and low privileges required, with no user interaction needed. The impact is limited to integrity, as unauthorized subscription changes can be made. There is no vendor-provided patch or official remediation at this time.

An authenticated attacker with Subscriber-level access or higher can bypass authorization controls to subscribe to inactive membership plans by manipulating the 'change_plan_sub_id' parameter during checkout. This unauthorized action affects the integrity of membership plan subscriptions but does not compromise confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level user capabilities where possible and monitor for unusual subscription activity. Avoid relying on inactive membership plans for critical access control. No vendor advisory or patch links are currently available.