{"id":"CVE-2026-123661","kind":"vulnerability","aliases":["CVE-2026-123661"],"related":[],"title":"ProfilePress WordPress plugin lets subscribers reach deactivated membership plans","description":"The ProfilePress  WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.","summary":"The ProfilePress WordPress plugin before 4.17.4 does not check whether a membership plan is still active when checkout changes an existing subscription. A subscriber with any subscription can enroll in plans the site owner has deactivated, including free plans that grant a user role.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["membership-sites","package","profilepress","wordpress"],"not_affected_if":["plugin-not-installed","version-4.17.4-or-later"],"how_to_check":"- Check the installed ProfilePress version in the WordPress plugins list or the plugin's main file header; versions before `4.17.4` are affected.\n- Review whether the site uses ProfilePress membership plans, and whether any plans have been deactivated.","fix":"- ProfilePress: `4.17.4` (the first version not described as affected).","status":"open","published_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:20+00:00","updated_at":"2026-11-11T06:27:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:20Z","model":"claude-haiku-5-5","output":{"fix":"- ProfilePress: `4.17.4` (the first version not described as affected).","reach":"internet","title":"ProfilePress WordPress plugin lets subscribers reach deactivated membership plans","impact":"medium","summary":"The ProfilePress WordPress plugin before 4.17.4 does not check whether a membership plan is still active when checkout changes an existing subscription. A subscriber with any subscription can enroll in plans the site owner has deactivated, including free plans that grant a user role.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","profilepress","membership-sites"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"subscribers gain access to deactivated plans, including role-granting free plans","analyst_note":"","how_to_check":"- Check the installed ProfilePress version in the WordPress plugins list or the plugin's main file header; versions before `4.17.4` are affected.\n- Review whether the site uses ProfilePress membership plans, and whether any plans have been deactivated.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-4.17.4-or-later"],"who_is_affected":"Sites running the ProfilePress WordPress plugin before 4.17.4 that sell or grant membership plans. The exposure requires an existing subscriber account, and the risk is highest where deactivated plans grant a user role. Sites that do not use ProfilePress memberships can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4542,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123661':12A,15A '-2026':11A,14A '4.17.4':27B,71C 'activ':37B,81C 'allow':91C 'chang':40B,87C 'check':30B,74C 'checkout':39B,83C 'cve':10A,13A 'deactiv':7A,57B,107C 'enrol':50B 'exist':42B,89C 'free':59B,109C 'grant':62B,112C 'hold':93C 'includ':58B,108C 'let':4A 'membership':8A,17B,33B,77C 'membership-sit':16B 'owner':55B,105C 'packag':19B 'plan':9A,34B,52B,60B,78C,102C,110C 'plugin':3A,25B,69C 'profilepress':1A,20B,23B,67C 'reach':6A 'role':65B,115C 'site':18B,54B,104C 'still':36B,80C 'subscrib':5A,45B,92C,100C 'subscript':43B,48B,90C,95C 'use':85C 'user':64B,114C 'whether':31B 'wordpress':2A,21B,24B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ProfilePress WordPress plugin before 4.17.4 that sell or grant membership plans. The exposure requires an existing subscriber account, and the risk is highest where deactivated plans grant a user role. Sites that do not use ProfilePress memberships can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","membershipsites","package","profilepress","wordpress"],"campaign_type":null,"search_a":"'-123661':12A,15A '-2026':11A,14A 'cve':10A,13A 'deactiv':7A 'let':4A 'membership':8A 'plan':9A 'plugin':3A 'profilepress':1A 'reach':6A 'subscrib':5A 'wordpress':2A","search_b":"'4.17.4':27B 'activ':37B 'chang':40B 'check':30B 'checkout':39B 'deactiv':57B 'enrol':50B 'exist':42B 'free':59B 'grant':62B 'includ':58B 'membership':17B,33B 'membership-sit':16B 'owner':55B 'packag':19B 'plan':34B,52B,60B 'plugin':25B 'profilepress':20B,23B 'role':65B 'site':18B,54B 'still':36B 'subscrib':45B 'subscript':43B,48B 'user':64B 'whether':31B 'wordpress':21B,24B","search_c":"'4.17.4':71C 'activ':81C 'allow':91C 'chang':87C 'check':74C 'checkout':83C 'deactiv':107C 'exist':89C 'free':109C 'grant':112C 'hold':93C 'includ':108C 'membership':77C 'owner':105C 'plan':78C,102C,110C 'plugin':69C 'profilepress':67C 'role':115C 'site':104C 'still':80C 'subscrib':92C,100C 'subscript':90C,95C 'use':85C 'user':114C 'wordpress':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123661","severity":null,"published_at":"2026-11-11T06:17:18+00:00","modified_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}