Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress, CVE-2026-123657

CVE, Research URL: CVE-2026-123657
Home page URL: Security reports for Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Application: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Published on: Nov 11, 2026
Research Description: The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them.
Affected versions: max 4.17.6.
Status: vulnerable

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile &amp; Restrict Content – ProfilePress, CVE-2026-123657