A critical unauthenticated SQL injection vulnerability (CVE-2025-49870) was discovered in the WordPress Paid Membership Subscriptions plugin (versions ≤2.15.1), exposing over 10,000 websites managing memberships and recurring payments. The flaw stems from improper handling of PayPal IPN payment IDs, allowing attackers to inject malicious SQL queries without authentication.Exploitation could lead to unauthorized database access, enabling attackers to steal sensitive user data (e.g., payment details, membership records) or modify/delete critical records. While no active exploits are confirmed, the risk is severe due to the plugin’s widespread use in e-commerce, subscription services, and membership-based platforms.The vulnerability was patched in version 2.15.2, which enforces numeric validation for payment IDs, replaces vulnerable query concatenation with prepared statements, and strengthens input sanitization. Failure to update leaves sites vulnerable to data breaches, financial fraud, and reputational damage, particularly if customer payment data is compromised. Users are urged to immediately upgrade to mitigate risks.