CVE-2026-123659: ProfilePress < 4.17.6 - Unauthenticated Member Directory Role Restriction Bypass and User Meta Disclosure

Q: Who can exploit this issue?

Any unauthenticated remote user can exploit it. No account, privileges, or user interaction are required.

Q: What information can be exposed?

An attacker can list user accounts that a member directory was configured to hide and recover user meta values for users returned by the directory.

Q: Are all ProfilePress installations affected by default?

The issue affects ProfilePress versions before 4.17.6 when member directories are present and configured to hide accounts or use role and user-meta filtering. The provided information does not establish that every default installation exposes such data.

Q: How can I determine whether my site is affected?

Check whether ProfilePress is installed at a version earlier than 4.17.6 and whether it has member directories configured with role restrictions, user-meta filters, or hidden accounts. Such directories may accept unconfigured filters from unauthenticated requests.

Q: What should be prioritized for remediation?

Update ProfilePress to version 4.17.6 or later. Until it is updated, treat publicly accessible member directories as potential sources of account enumeration and user-meta disclosure.

Published Nov 11, 2026

Updated

The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users.

Affected Software

1 affected component

ProfilePress ProfilePress<4.17.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ProfilePress to a version that resolves this vulnerability.
Fixed in 4.17.6

Event History

Nov 11, 2026

CVE Published

via MITRE·07:33 AM

Data Sourced

via MITRE·07:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote user can exploit it. No account, privileges, or user interaction are required.

What information can be exposed?

An attacker can list user accounts that a member directory was configured to hide and recover user meta values for users returned by the directory.

Are all ProfilePress installations affected by default?

The issue affects ProfilePress versions before 4.17.6 when member directories are present and configured to hide accounts or use role and user-meta filtering. The provided information does not establish that every default installation exposes such data.

How can I determine whether my site is affected?

Check whether ProfilePress is installed at a version earlier than 4.17.6 and whether it has member directories configured with role restrictions, user-meta filters, or hidden accounts. Such directories may accept unconfigured filters from unauthenticated requests.

What should be prioritized for remediation?

Update ProfilePress to version 4.17.6 or later. Until it is updated, treat publicly accessible member directories as potential sources of account enumeration and user-meta disclosure.

CVE-2026-123659: ProfilePress < 4.17.6 - Unauthenticated Member Directory Role Restriction Bypass and User Meta Disclosure

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are all ProfilePress installations affected by default?

How can I determine whether my site is affected?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are all ProfilePress installations affected by default?

How can I determine whether my site is affected?

What should be prioritized for remediation?