---
id: "CVE-2026-123659"
page: "https://infrastack.ai/live/CVE-2026-123659"
kind: "vulnerability"
aliases: ["CVE-2026-123659"]
title: "ProfilePress WordPress plugin leaks hidden user accounts and profile metadata"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "profilepress", "self-hosted", "wordpress"]
not_affected_if: ["version-4.17.6-or-later"]
published_at: "2026-11-11T08:17:17+00:00"
first_seen_at: "2026-11-11T08:26:05+00:00"
updated_at: "2026-11-11T08:27:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123659", "first_seen_at": "2026-11-11T08:26:05+00:00"}]
exploit_sources: []
---

# ProfilePress WordPress plugin leaks hidden user accounts and profile metadata

Link for people: https://infrastack.ai/live/CVE-2026-123659 (this .md is for agents)

The ProfilePress WordPress plugin before 4.17.6 accepts role and user meta filters in its member directories that the administrator did not configure. An unauthenticated visitor can list accounts the directory was meant to hide and read user meta values of those accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ProfilePress version in the WordPress admin plugins list or the plugin header in `wp-content/plugins/wp-user-avatar/` (unknown whether the sources name the exact plugin folder)

## Fix

- ProfilePress: move to `4.17.6` or later (per the description, versions before 4.17.6 are affected)

## Timeline

- 2026-11-11T08:26:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123659

## From the sources

The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_