CVE-2026-123661: medium-severity vulnerability in ProfilePress
ProfilePress 4.16.13 - 4.17.3 - Subscriber+ Inactive Membership Plan Subscription via Plan-Change Checkout
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.3epss 0.2%
The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · ProfilePresspublic PoCs found — 1
cve_referencewpscan.com/vulnerability/e70de446-003c-4198-9951-e0fb336978f8/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ProfilePress
In the same product, most dangerous first.
CVE-2026-123659MEDIUMProfilePress < 4.17.6 - Unauthenticated Member Directory Role Restriction Bypass and User Meta DisclosureEPSS 0.3%CVE-2026-19848MEDIUMProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display NameEPSS 0.3%CVE-2026-123657MEDIUMProfilePress < 4.17.6 - Unauthenticated Inactive Membership Plan Enrollment via Negative Plan IDEPSS 0.2%CVE-2026-123656MEDIUMProfilePress < 4.17.6 - Unauthenticated Restricted Content Disclosure via REST APIEPSS 0.2%