Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-10820 Insecure Direct Object Reference in Paid Membership Plugin WordPress Before 4.16.17 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-10820
Post summary
The text references CVE-2026-10820, noting an IDOR vulnerability in Paid Membership Plugin WordPress prior to version 4.16.17, but provides no information about patches, exploits, or PoC.
🚨*CVE* CVE-2026-10820 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the u… https://www.cve.org/CVERecord?id=CVE-2026-10820 ----- Traducción: CVE-2026-10820 El … http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑10820 for a WordPress plugin prior to version 4.16.17, linking to the CVE record, but provides no exploit, patch, or detailed technical information.
CVE-2026-10820 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the u… https://www.cve.org/CVERecord?id=CVE-2026-10820
Post summary
The post simply cites the CVE for a WordPress plugin, offering no proof‑of‑concept, exploit, or mitigation information.