{"id":"CVE-2026-123659","kind":"vulnerability","aliases":["CVE-2026-123659"],"related":[],"title":"ProfilePress WordPress plugin leaks hidden user accounts and profile metadata","description":"The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users.","summary":"The ProfilePress WordPress plugin before 4.17.6 accepts role and user meta filters in its member directories that the administrator did not configure. An unauthenticated visitor can list accounts the directory was meant to hide and read user meta values of those accounts.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","profilepress","self-hosted","wordpress"],"not_affected_if":["version-4.17.6-or-later"],"how_to_check":"- Check the installed ProfilePress version in the WordPress admin plugins list or the plugin header in `wp-content/plugins/wp-user-avatar/` (unknown whether the sources name the exact plugin folder)","fix":"- ProfilePress: move to `4.17.6` or later (per the description, versions before 4.17.6 are affected)","status":"open","published_at":"2026-11-11T08:17:17+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:59+00:00","updated_at":"2026-11-11T08:27:59+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T08:27:59Z","model":"claude-haiku-5-5","output":{"fix":"- ProfilePress: move to `4.17.6` or later (per the description, versions before 4.17.6 are affected)","reach":"internet","title":"ProfilePress WordPress plugin leaks hidden user accounts and profile metadata","impact":"low","summary":"The ProfilePress WordPress plugin before 4.17.6 accepts role and user meta filters in its member directories that the administrator did not configure. An unauthenticated visitor can list accounts the directory was meant to hide and read user meta values of those accounts.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","profilepress","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Hidden accounts and user meta values exposed to unauthenticated visitors","analyst_note":"","how_to_check":"- Check the installed ProfilePress version in the WordPress admin plugins list or the plugin header in `wp-content/plugins/wp-user-avatar/` (unknown whether the sources name the exact plugin folder)\n- unknown for other checks: the sources do not say which directory settings or endpoints are affected","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.17.6-or-later"],"who_is_affected":"Sites running the ProfilePress WordPress plugin before 4.17.6 that publish member directories. The sources do not say whether default configurations are exposed; sites without member directories are likely not affected. Sites on 4.17.6 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4541,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123659':13A,16A '-2026':12A,15A '4.17.6':28B,70C 'accept':29B,83C 'account':7A,50B,64B,95C 'administr':41B,89C 'allow':90C 'configur':44B,86C 'cve':11A,14A 'directori':38B,52B,82C,97C 'filter':34B,79C 'hidden':5A 'hide':56B,101C 'host':21B 'leak':4A 'list':49B,94C,109C 'meant':54B 'member':37B,81C 'meta':33B,60B,78C,106C 'metadata':10A 'plugin':3A,26B,68C 'profil':9A 'profilepress':1A,18B,24B,66C 'read':58B 'recov':104C 'restrict':73C 'role':30B,75C 'self':20B 'self-host':19B 'set':99C 'unauthent':46B,91C 'user':6A,32B,59B,77C,92C,105C,110C 'valu':61B,107C 'visitor':47B 'wordpress':2A,22B,25B,67C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ProfilePress WordPress plugin before 4.17.6 that publish member directories. The sources do not say whether default configurations are exposed; sites without member directories are likely not affected. Sites on 4.17.6 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","profilepress","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123659':13A,16A '-2026':12A,15A 'account':7A 'cve':11A,14A 'hidden':5A 'leak':4A 'metadata':10A 'plugin':3A 'profil':9A 'profilepress':1A 'user':6A 'wordpress':2A","search_b":"'4.17.6':28B 'accept':29B 'account':50B,64B 'administr':41B 'configur':44B 'directori':38B,52B 'filter':34B 'hide':56B 'host':21B 'list':49B 'meant':54B 'member':37B 'meta':33B,60B 'plugin':26B 'profilepress':18B,24B 'read':58B 'role':30B 'self':20B 'self-host':19B 'unauthent':46B 'user':32B,59B 'valu':61B 'visitor':47B 'wordpress':22B,25B","search_c":"'4.17.6':70C 'accept':83C 'account':95C 'administr':89C 'allow':90C 'configur':86C 'directori':82C,97C 'filter':79C 'hide':101C 'list':94C,109C 'member':81C 'meta':78C,106C 'plugin':68C 'profilepress':66C 'recov':104C 'restrict':73C 'role':75C 'set':99C 'unauthent':91C 'user':77C,92C,105C,110C 'valu':107C 'wordpress':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123659","severity":null,"published_at":"2026-11-11T08:17:17+00:00","modified_at":"2026-11-11T08:17:17+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}