Insecure Direct Object Reference in ProfilePress Plugin by WordPress
CVE-2026-3453

8.1HIGH

Key Information:

Vendor

WordPress
Status
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – Profilepress
Vendor
CVE Published:
11 March 2026

What is CVE-2026-3453?

The ProfilePress plugin is susceptible to Insecure Direct Object Reference due to a lack of ownership validation in the process_checkout() function. The vulnerable AJAX handler, ppress_process_checkout, allows authenticated users with Subscriber-level or above access to manipulate the change_plan_sub_id parameter. This flaw enables attackers to cancel or expire other users' active subscriptions, leading to unauthorized access loss. It is crucial to apply security updates promptly to mitigate this issue and safeguard user subscriptions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress * <= 4.16.11

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-user-avatar...
https://plugins.trac.wordpress.org/browser/wp-user-avatar...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supanat Konprom
JSON
.