CVE-2023-39990 is a Medium severity (CVSS 5.4) missing authorization flaw in the Courses for Membership add-on for Paid Memberships Pro for WordPress, up to and including version 1.2.3. Patchstack lists version 1.2.4 as the fix. Update to 1.2.4 or later, or remove the plugin if you do not use it.
What's affected
Affected: the Courses for Membership add-on for Paid Memberships Pro from n/a through 1.2.3, per the record and Patchstack. Fixed: 1.2.4, according to Patchstack.
Severity: the record's CVSS 3.1 score is 5.4 (Medium). Patchstack's own priority view differs in tone: Patchstack priority Low. Both can be true, since CVSS describes impact if exploited while priority reflects how likely exploitation is. The privilege needed is a logged in user.
How to check if you're exposed
From a shell on the server with WP-CLI installed:
wp plugin get pmpro-courses --field=version
In the WordPress admin, open Plugins and read the version under the plugin name. If the version is 1.2.3 or lower, you are in the affected range. If the command finds nothing, the plugin is not installed on that site. Check every site in a multisite network and every staging copy.
What to do now
- Update the PMPro Courses plugin to 1.2.4 or later from your normal update channel.
- If you do not use the plugin, deactivate and delete it rather than leaving it installed.
- Review accounts with elevated or contributor level roles and remove ones you do not recognize.
- Check logs and recent changes for actions you did not make, since a missing authorization flaw may leave little trace.
- Add the plugin and theme versions to your inventory so future advisories can be matched quickly.
Why it matters
The weakness is CWE-862 (missing authorization). In practice, an authenticated user can perform an action the plugin does not check them for. The record does not give more detail than that, and I will not guess at specifics beyond what Patchstack publishes.
Broken access control is the most common class in WordPress plugin advisories. The code does what it was written to do, but it forgets to ask whether the caller is allowed. Fixes are usually small, which is why updating is cheap. NVD published this record on 2024-06-19, and the KEV flag is false, so there is no sign of exploitation from the sources checked.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Quick check
Does this need a login?
The privilege listed is: a logged in user. The CVSS vector in the record matches that.
Is it being exploited?
The record's KEV flag is false and Patchstack's page does not claim exploitation. Update anyway, because the fix is a normal version bump.
Sources
Last reviewed: 19 October 2026.
