CVE-2026-123661

— UNSCORED

Published 2026-11-11 · Updated 2026-11-11

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.

All references

https://wpscan.com/vulnerability/e70de446-003c-4198-9951-e0fb336978f8/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.