CVE-2023-6187: Paid Memberships Pro WordPress plugin arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.8 with high EPSS and a patch available, but exploitation requires authenticated subscriber access and specific plugin configuration.

What it is

The Paid Memberships Pro plugin for WordPress fails to properly validate file types in the pmpro_paypalexpress_session_vars_for_user_fields function in versions up to and including 2.12.3. An authenticated attacker with subscriber-level access or above can upload arbitrary files to the server, which may lead to remote code execution. Exploitation requires 2Checkout or PayPal Express as the payment method and a custom user field configured to be visible only at profile, not at checkout.

Impact

An attacker gains the ability to write arbitrary files to the affected site's server, potentially achieving remote code execution and full compromise of the WordPress installation.

Attack surface

Reachable over the network through the plugin's user field handling; the attacker must be authenticated with at least subscriber privileges and no user interaction is required. Exploitation depends on specific plugin configuration (PayPal Express or 2Checkout payment method plus a profile-only custom user field).

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at roughly 0.51 (98.9th percentile), indicating elevated likelihood of exploitation activity. Reference tags include Patch and Third Party Advisory, with no public exploit tag present.

What to do

• Update Paid Memberships Pro to version 2.12.4 or later, which contains the patch.
• If immediate patching is not possible, disable PayPal Express and 2Checkout payment methods and remove profile-only custom user fields.
• Restrict subscriber account creation and review existing low-privilege accounts for suspicious activity.
• Enforce file upload restrictions at the web server or WAF layer to block executable file types in upload directories.
• Monitor plugin configuration for the specific payment method and custom field combination required for exploitation.

Detection

• Review web server and WordPress upload directories for unexpected or executable files (for example .php) created by low-privilege users.
• Audit plugin settings for PayPal Express or 2Checkout payment methods combined with profile-only custom user fields.
• Monitor subscriber-level accounts for anomalous file upload requests or POST activity to plugin endpoints.
• Check logs for requests touching the pmpro_paypalexpress_session_vars_for_user_fields code path or related field handling.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.