CVE-2026-123656: medium-severity vulnerability in ProfilePress
ProfilePress < 4.17.6 - Unauthenticated Restricted Content Disclosure via REST API
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.2%
The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · ProfilePresspublic PoCs found — 1
cve_referencewpscan.com/vulnerability/5a670095-e8c7-4317-a929-a896d01ee648/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ProfilePress
In the same product, most dangerous first.
CVE-2026-123659MEDIUMProfilePress < 4.17.6 - Unauthenticated Member Directory Role Restriction Bypass and User Meta DisclosureEPSS 0.3%CVE-2026-19848MEDIUMProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display NameEPSS 0.3%CVE-2026-123657MEDIUMProfilePress < 4.17.6 - Unauthenticated Inactive Membership Plan Enrollment via Negative Plan IDEPSS 0.2%CVE-2026-123661MEDIUMProfilePress 4.16.13 - 4.17.3 - Subscriber+ Inactive Membership Plan Subscription via Plan-Change CheckoutEPSS 0.2%