This vulnerability (CVE-2026-57659) is an unauthenticated CSRF issue in the Paid Memberships Pro - Add Member From Admin plugin, versions up to 0.7.2. It allows attackers to trick administrators into executing unwanted actions by submitting forged requests without proper verification. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

Successful exploitation could lead to unauthorized administrative actions performed without the administrator's consent, potentially compromising the confidentiality, integrity, and availability of the affected system. Given the unauthenticated nature of the CSRF, attackers do not need prior access to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider implementing CSRF protections such as verifying request origins and employing anti-CSRF tokens where possible. Monitoring for unusual administrative activity is also advisable.