CVE-2026-123656: ProfilePress < 4.17.6 - Unauthenticated Restricted Content Disclosure via REST API
The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ProfilePress WordPress pluginto a version that resolves this vulnerability.Fixed in 4.17.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using ProfilePress versions before 4.17.6 may be exposed if they protect page content with affected ProfilePress content protection rules. Unauthenticated users can access the protected content through the WordPress REST API.
Does an attacker need an account or special access?
No. The issue can be exploited by unauthenticated users, so no WordPress account is required.
How can I tell whether my site may be affected?
Check whether ProfilePress is installed at a version earlier than 4.17.6 and whether it is used to restrict page content. Affected protected content may be readable through REST API responses even when it is restricted through the normal site interface.
What should I do if I cannot update immediately?
The provided information does not identify a temporary configuration workaround. Until an update is applied, review and limit REST API exposure where feasible, and treat content protected by affected ProfilePress rules as potentially accessible to unauthenticated users.