CVE-2026-123657: ProfilePress < 4.17.6 - Unauthenticated Inactive Membership Plan Enrollment via Negative Plan ID
The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor can exploit it. The issue affects sites using a vulnerable ProfilePress version where a deactivated membership plan has an attached WordPress role.
What does an attacker need to do to gain the role from an inactive plan?
The attacker needs to submit a membership enrollment using a negative plan identifier that corresponds to a deactivated plan. No authenticated account is required.
Are inactive membership plans protected from enrollment on affected versions?
No. On versions before 4.17.6, negative plan identifiers can bypass the check intended to prevent enrollment in inactive plans.
What should be checked when assessing possible impact?
Review deactivated membership plans and identify the WordPress roles attached to them. Also review whether unexpected users were created or assigned roles associated with inactive plans.