---
id: "CVE-2026-123661"
page: "https://infrastack.ai/live/CVE-2026-123661"
kind: "vulnerability"
aliases: ["CVE-2026-123661"]
title: "ProfilePress WordPress plugin lets subscribers reach deactivated membership plans"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["membership-sites", "package", "profilepress", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-4.17.4-or-later"]
published_at: "2026-11-11T06:17:18+00:00"
first_seen_at: "2026-11-11T06:25:43+00:00"
updated_at: "2026-11-11T06:27:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123661", "first_seen_at": "2026-11-11T06:25:43+00:00"}]
exploit_sources: []
---

# ProfilePress WordPress plugin lets subscribers reach deactivated membership plans

Link for people: https://infrastack.ai/live/CVE-2026-123661 (this .md is for agents)

The ProfilePress WordPress plugin before 4.17.4 does not check whether a membership plan is still active when checkout changes an existing subscription. A subscriber with any subscription can enroll in plans the site owner has deactivated, including free plans that grant a user role.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ProfilePress version in the WordPress plugins list or the plugin's main file header; versions before `4.17.4` are affected.
- Review whether the site uses ProfilePress membership plans, and whether any plans have been deactivated.

## Fix

- ProfilePress: `4.17.4` (the first version not described as affected).

## Timeline

- 2026-11-11T06:25:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123661

## From the sources

The ProfilePress  WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_