ProfilePress WordPress plugin: Broken access control in membership plan signup
Summary
The ProfilePress WordPress plugin before version 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active. Unauthenticated visitors can therefore enrol in membership plans that an administrator has deactivated and receive the role attached to them. The impact is an unauthorised role assignment, which can grant access to restricted content or features if the role is used for gating.
Affected
- ProfilePress WordPress plugin (wp-user-avatar) versions before 4.17.6
- The CNA record lists 0 to before 4.17.6; VulDB lists 4.17.0 to 4.17.5 (CNA range is considered authoritative)
Fixed in
- Upgrade to ProfilePress 4.17.6 or later; the latest release on WordPress.org is recommended
- Vendor changelog naming this fix: Unknown.
Workaround
- No vendor-documented workaround is known.
- Interim measure (not from a source): review membership plans and roles for unexpected signups and verify the plan-to-role mapping.
Exploitation
- Not known to be exploited; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public exploit code indexed in Metasploit or Exploit-DB; technical details reported as unknown by VulDB.
Our recommendation
- Inventory WordPress sites running ProfilePress and confirm the installed version.
- Update ProfilePress to the latest release (at least 4.17.6).
- After patching, review recent registrations and role assignments on sites that sell or gate content by membership.
- Treat as routine priority unless role-gated sensitive content is in use; re-check exploitation status as the CVE is recent.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- CVE Record CVE-2026-123657 www.cve.org
- VulDB entry 435667 vuldb.com
- OffSeq Radar threat entry radar.offseq.com
- WordPress.org plugin page (wp-user-avatar) wordpress.org
- ProfilePress membership plans guide profilepress.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:04.
Original description (NVD)
The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.