CVE-2026-10820
ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.1EPSS 0.1%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
27 Jun 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected products
Unknown · Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Contentpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/cb7ad514-e0d5-4ff3-803a-918cdc194f39/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →