ProfilePress: Incorrect authorization in member directory filters
Summary
ProfilePress, a WordPress plugin for memberships, registration and user profiles, does not limit the role and user meta filters of its member directories to the values set by the administrator. An unauthenticated attacker can list accounts that the directory was set to hide and read user meta values of the listed users. The issue requires a member directory published on a public website.
Affected
- ProfilePress versions before 4.17.6 (the CNA lists all versions from 0 to before 4.17.6; VulDB names up to 4.17.5)
Fixed in
- Version 4.17.6 according to the WPScan advisory and the WordPress.org changelog. Check the current release on WordPress.org before choosing a target version.
Workaround
- Unknown.
- Until the update is applied, take public member directories offline or hide them from anonymous visitors (own recommendation, not from the vendor).
- VulDB suggests limiting public access to member directory endpoints and using web application firewall rules (third-party suggestion).
Exploitation
- No evidence of exploitation in the wild. The CVE is not in CISA KEV.
- No public proof of concept confirmed as of publication.
- CISA SSVC: automatable yes, technical impact partial.
Our recommendation
- Identify all sites running ProfilePress below 4.17.6 and check whether they publish member directories.
- Update ProfilePress to the current release together with the other fixes in the same update, such as CVE-2026-123657 and CVE-2026-123656.
- Afterwards, verify as an anonymous visitor that hidden accounts and user meta values no longer appear.
- If the directories contain personal data, assess the data protection impact for Swiss clients under the revDSG.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- CVE Record CVE-2026-123659 www.cve.org
- VulDB CVE-2026-123659 vuldb.com
- VulDB entry 435693 vuldb.com
- WordPress.org plugin wp-user-avatar wordpress.org
- The Hacker Wire CVE-2026-123659 www.thehackerwire.com
- OffSeq Radar CVE-2026-123659 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:58.
Original description (NVD)
The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.