---
id: "CVE-2026-123656"
page: "https://infrastack.ai/live/CVE-2026-123656"
kind: "vulnerability"
aliases: ["CVE-2026-123656"]
title: "ProfilePress WordPress plugin: unauthenticated users can read protected page content"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "profilepress", "self-hosted", "wordpress"]
not_affected_if: ["fixed-version", "no-content-protection-rules"]
published_at: "2026-11-11T06:17:17+00:00"
first_seen_at: "2026-11-11T06:25:43+00:00"
updated_at: "2026-11-11T06:27:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123656", "first_seen_at": "2026-11-11T06:25:43+00:00"}]
exploit_sources: []
---

# ProfilePress WordPress plugin: unauthenticated users can read protected page content

Link for people: https://infrastack.ai/live/CVE-2026-123656 (this .md is for agents)

The ProfilePress WordPress plugin before 4.17.6 fails to enforce some content protection rule conditions when content is rendered outside the main query. An unauthenticated visitor can read the content of pages that should be restricted, through the REST API.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ProfilePress version in the WordPress admin plugin list, or the plugin header in `wp-content/plugins/wp-user-avatar/` (unknown whether this is the exact plugin path)
- Look for protected pages and test whether their content is returned by an unauthenticated request to the WordPress REST API (unknown whether the sources give a specific endpoint)

## Fix

- ProfilePress WordPress plugin: move to `4.17.6` or later

## Timeline

- 2026-11-11T06:25:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123656

## From the sources

The ProfilePress  WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_