CVE-2026-123656 · Package
NO FIX YET · SEE WHAT TO DO
The ProfilePress WordPress plugin before 4.17.6 fails to enforce some content protection rule conditions when content is rendered outside the main query. An unauthenticated visitor can read the content of pages that should be restricted, through the REST API.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the ProfilePress WordPress plugin before 4.17.6 that use content protection rules on pages. The exposure depends on pages being rendered outside the main query and reachable through the REST API. Sites on 4.17.6 or later, or without ProfilePress content protection rules, are not affected by this report.
Not affected if fixed-version, no-content-protection-rules
Who cares profilepress, self-hosted, wordpress
wp-content/plugins/wp-user-avatar/ (unknown whether this is the exact plugin path)4.17.6 or laterThe ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.