Paid Memberships Pro Missing Authorization Vulnerability in Stripe Webhook Management

A vulnerability exists in the Paid Memberships Pro plugin for WordPress, affecting all versions through 3.6.5. The issue arises from a lack of proper capability checks in several AJAX handlers related to Stripe webhook management. This oversight allows authenticated attackers with Subscriber-level access or higher to unauthorizedly delete, create, or modify the site's Stripe webhook configuration. Such actions disrupt payment processing, subscription renewals, cancellations, and management of failed payments.

Impact

Exploitation of this vulnerability disrupts the site's payment processing and subscription management functions, including handling renewals, cancellations, and failed payments.

Remediation

Users are advised to update the Paid Memberships Pro plugin to version 3.6.6 or a newer patched version.