CVE-2026-123661

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans tha...

EUVD-2026-123196

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans tha...

CVE-2026-123661

The ProfilePress WordPress plugin (versions 4.16.13 - 4.17.3 ) contains a vulnerability where it fails to verify if a membership plan is active when a user utilizes the checkout process to modify an existing subscription. This Missing Authorization (CWE-862) flaw allows subscribers holding any va...

CVE-2026-123661: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is…

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans tha...

PT-2026-145032

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans tha...