This vulnerability (CVE-2026-59539) affects Cozmoslabs Paid Member Subscriptions plugin versions up to 3.0.7. It is an authorization bypass issue caused by insecure direct object references (IDOR) where a user-controlled key can be manipulated to access or modify subscription information without proper authorization. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level has been disclosed as of the published date.

An attacker can exploit this vulnerability to bypass authorization controls and potentially modify subscription data in the Paid Member Subscriptions plugin. This compromises the integrity of subscription information but does not affect confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No vendor-provided mitigation or temporary fix is currently available.