CVE-2026-3445
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The ProfilePress plugin for WordPress up to version 4.16.11 has a vulnerability allowing unauthorized membership payment bypass. Missing ownership verification on the change_plan_sub_id parameter in process_checkout() allows authenticated attackers (subscriber level and above) to reference another user's active subscription, manipulate proration calculations, and obtain paid lifetime membership plans without payment.
Risk Assessment
Attackers can obtain paid memberships without cost, leading to financial losses.
Recommendation
Update the ProfilePress plugin to version 4.16.12 or later.
Other vulnerabilities in ProfilePress
See all- CVE-2026-96518Medium
The ProfilePress (wp-user-avatar) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.17.3.
- CVE-2026-96337Medium
The ProfilePress (wp-user-avatar) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.17.3.
- CVE-2026-92551Medium
The ProfilePress plugin for WordPress up to version 4.17.4 is vulnerable to reflected XSS via the 'ppress_billing_address' parameter. Unauthenticated attackers can inject scripts that execute when a user clicks a crafted link.
- CVE-2026-92536High
The ProfilePress plugin for WordPress is vulnerable to sensitive information exposure in versions up to and including 4.17.4 via the get_user_profile_structure function. Authenticated attackers with subscriber-level access and above can extract other users' email addresses, login names, and registration dates. When the users_can_register option is enabled, unauthenticated attackers can also exploit this via registration.
- CVE-2026-85658High
The ProfilePress plugin for WordPress in all versions up to and including 4.17.2 is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, allowing authenticated attackers with subscriber-level access and above to execute arbitrary shortcodes.
- CVE-2026-66047High
The ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability. Attackers can install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler, achieving PHP code execution as the web-server user.
- CVE-2026-19848Medium
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.
- CVE-2026-18385Medium
The ProfilePress plugin for WordPress up to version 4.16.19 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode. Authenticated attackers with subscriber-level access can execute arbitrary shortcodes, and partial mitigations can be bypassed via various render paths.
- CVE-2026-13352High
The ProfilePress plugin for WordPress up to version 4.16.18 is vulnerable to arbitrary file upload. The allowed_mime_types function globally adds executable extensions (.exe, .apk, .msi) to the MIME allowlist without scoping to digital product contexts. This allows authenticated attackers with author-level access or above to upload executable files, leading to remote code execution.
- CVE-2026-41556Medium
There is a Cross Site Scripting (XSS) vulnerability in ProfilePress versions <= 4.16.13 related to subscribers.
Original NVD description (English source)
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the `change_plan_sub_id` parameter in the `process_checkout()` function. This makes it possible for authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to manipulate proration calculations, allowing them to obtain paid lifetime membership plans without payment via the `ppress_process_checkout` AJAX action.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS