CVE-2026-97249 is classified as CWE-290 (Authentication Bypass by Spoofing) affecting the Paid Member Subscriptions plugin by Cozmoslabs. Versions up to 3.0.9 are vulnerable to an unauthenticated bypass that allows attackers to circumvent authentication mechanisms. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No known exploits are reported in the wild, and no vendor patch or advisory information is currently available.

An unauthenticated attacker can bypass authentication controls, potentially allowing unauthorized actions that impact the integrity of the system. There is no confidentiality or availability impact reported. The medium severity reflects the potential for limited unauthorized changes without requiring authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor official Cozmoslabs communications for updates. No specific mitigations or temporary fixes are documented at this time.