CVE-2026-123661 · Package
NO FIX YET · SEE WHAT TO DO
The ProfilePress WordPress plugin before 4.17.4 does not check whether a membership plan is still active when checkout changes an existing subscription. A subscriber with any subscription can enroll in plans the site owner has deactivated, including free plans that grant a user role.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the ProfilePress WordPress plugin before 4.17.4 that sell or grant membership plans. The exposure requires an existing subscriber account, and the risk is highest where deactivated plans grant a user role. Sites that do not use ProfilePress memberships can skip it.
Not affected if plugin-not-installed, version-4.17.4-or-later
Who cares membership-sites, profilepress, wordpress
4.17.4 are affected.4.17.4 (the first version not described as affected).The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.