{"id":"CVE-2026-123656","kind":"vulnerability","aliases":["CVE-2026-123656"],"related":[],"title":"ProfilePress WordPress plugin: unauthenticated users can read protected page content","description":"The ProfilePress  WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.","summary":"The ProfilePress WordPress plugin before 4.17.6 fails to enforce some content protection rule conditions when content is rendered outside the main query. An unauthenticated visitor can read the content of pages that should be restricted, through the REST API.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","profilepress","self-hosted","wordpress"],"not_affected_if":["fixed-version","no-content-protection-rules"],"how_to_check":"- Check the installed ProfilePress version in the WordPress admin plugin list, or the plugin header in `wp-content/plugins/wp-user-avatar/` (unknown whether this is the exact plugin path)\n- Look for protected pages and test whether their content is returned by an unauthenticated request to the WordPress REST API (unknown whether the sources give a specific endpoint)","fix":"- ProfilePress WordPress plugin: move to `4.17.6` or later","status":"open","published_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:24+00:00","updated_at":"2026-11-11T06:27:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:24Z","model":"claude-haiku-5-5","output":{"fix":"- ProfilePress WordPress plugin: move to `4.17.6` or later","reach":"internet","title":"ProfilePress WordPress plugin: unauthenticated users can read protected page content","impact":"medium","summary":"The ProfilePress WordPress plugin before 4.17.6 fails to enforce some content protection rule conditions when content is rendered outside the main query. An unauthenticated visitor can read the content of pages that should be restricted, through the REST API.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","profilepress","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated visitors read content of pages meant to be restricted.","analyst_note":"Confirm the affected REST API routes and whether the fix is in 4.17.6 from the plugin changelog or the NVD entry.","how_to_check":"- Check the installed ProfilePress version in the WordPress admin plugin list, or the plugin header in `wp-content/plugins/wp-user-avatar/` (unknown whether this is the exact plugin path)\n- Look for protected pages and test whether their content is returned by an unauthenticated request to the WordPress REST API (unknown whether the sources give a specific endpoint)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-version","no-content-protection-rules"],"who_is_affected":"Sites running the ProfilePress WordPress plugin before 4.17.6 that use content protection rules on pages. The exposure depends on pages being rendered outside the main query and reachable through the REST API. Sites on 4.17.6 or later, or without ProfilePress content protection rules, are not affected by this report.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4532,"output_tokens":651,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123656':13A,16A '-2026':12A,15A '4.17.6':28B,67C 'allow':87C 'api':61B,103C 'condit':36B,78C 'content':10A,33B,38B,51B,75C,80C,93C 'correct':70C 'cve':11A,14A 'enforc':31B 'evalu':71C 'fail':29B 'host':21B 'main':43B,85C 'outsid':41B,83C 'packag':17B 'page':9A,53B,95C 'plugin':3A,26B,65C 'profilepress':1A,18B,24B,63C 'protect':8A,34B,76C,96C 'queri':44B,86C 'read':7A,49B,91C 'render':40B,82C 'rest':60B,102C 'restrict':57B 'rule':35B,77C,99C 'self':20B 'self-host':19B 'unauthent':4A,46B,88C 'user':5A,89C 'via':100C 'visitor':47B 'wordpress':2A,22B,25B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ProfilePress WordPress plugin before 4.17.6 that use content protection rules on pages. The exposure depends on pages being rendered outside the main query and reachable through the REST API. Sites on 4.17.6 or later, or without ProfilePress content protection rules, are not affected by this report.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","profilepress","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123656':13A,16A '-2026':12A,15A 'content':10A 'cve':11A,14A 'page':9A 'plugin':3A 'profilepress':1A 'protect':8A 'read':7A 'unauthent':4A 'user':5A 'wordpress':2A","search_b":"'4.17.6':28B 'api':61B 'condit':36B 'content':33B,38B,51B 'enforc':31B 'fail':29B 'host':21B 'main':43B 'outsid':41B 'packag':17B 'page':53B 'plugin':26B 'profilepress':18B,24B 'protect':34B 'queri':44B 'read':49B 'render':40B 'rest':60B 'restrict':57B 'rule':35B 'self':20B 'self-host':19B 'unauthent':46B 'visitor':47B 'wordpress':22B,25B","search_c":"'4.17.6':67C 'allow':87C 'api':103C 'condit':78C 'content':75C,80C,93C 'correct':70C 'evalu':71C 'main':85C 'outsid':83C 'page':95C 'plugin':65C 'profilepress':63C 'protect':76C,96C 'queri':86C 'read':91C 'render':82C 'rest':102C 'rule':77C,99C 'unauthent':88C 'user':89C 'via':100C 'wordpress':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123656","severity":null,"published_at":"2026-11-11T06:17:17+00:00","modified_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}