CVE-2026-123661: ProfilePress 4.16.13 - 4.17.3 - Subscriber+ Inactive Membership Plan Subscription via Plan-Change Checkout
The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Subscriber role or higher can exploit it, but they must already hold a subscription of their own.
What does an attacker need to do to exploit it?
The attacker needs to use checkout to change their existing subscription to a membership plan that the site owner has deactivated. The affected checkout path does not verify that the target plan remains active.
Are deactivated free plans affected?
Yes. Deactivated free plans can still be selected through the subscription plan-change checkout flow, including plans that grant a user role.
Which versions need remediation?
ProfilePress versions before 4.17.4 are affected. Updating to 4.17.4 or later addresses the missing active-plan check.