Discourse Subscription Plugin Higher Tier Access Vulnerability

A vulnerability in the Discourse subscription management plugin allows users to exploit the subscription system. Specifically, users can purchase a lower-tier subscription while simultaneously gaining access to benefits associated with a higher-tier subscription. This issue is present in Discourse versions 2026.1.0-latest to prior to 2026.1.3, 2026.2.0-latest to prior to 2026.2.2, and 2026.3.0-latest to prior to 2026.3.0.

Impact

Exploitation of this vulnerability allows users to access higher-tier subscription benefits without making the corresponding payment.

Reproduction

To reproduce this vulnerability, a user can subscribe to a lower-tier plan and then, during the subscription finalization process, switch to a higher-tier plan. This can be done by manipulating the 'plan' parameter in the checkout session data, taking advantage of the 3D Secure authentication flow.

Remediation

Users can disable the Discourse subscriptions plugin before upgrading to a patched version. Instructions for updating Discourse can be found in the Discourse Meta community.