CVE-2026-123661
ProfilePress 4.16.13 - 4.17.3 - Subscriber+ Inactive Membership Plan Subscription via Plan-Change Checkout
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.
| Vendor | unknown |
| Product | profilepress |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown profilepress
Be the first to know when new unknown vulnerabilities affecting unknown profilepress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / ProfilePress
4.16.13 < 4.17.4
References
Credits
Karthik Ramakrishnan WPScan