PT-2026-30316 · WordPress · Profilepress

Supakiad S · Published 2026-04-04 · Updated 2026-04-05 · CVE-2026-3445

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.16.12

Description The ProfilePress plugin for WordPress is susceptible to unauthorized membership payment bypass due to a missing ownership verification on the change plan sub id parameter within the process checkout() function. Authenticated attackers with subscriber-level access or higher can manipulate proration calculations by referencing another user's active subscription during checkout via the ppress process checkout AJAX action, potentially obtaining paid lifetime membership plans without payment.

Recommendations Update ProfilePress to version 4.16.12 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3445

Affected Products

Profilepress

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3445 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ae1e198b-0c0d-47aa-8a56-ec4e790c8022?source=cve · Note
• https://reddit.com/r/wpsafety/comments/1scywd0/weekly_cve_roundup_critical_rce_in_everest_forms · Reddit Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3474509%40wp-user-avatar%2Ftrunk&old=3473639%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=#file3 · Note
• https://twitter.com/CVEnew/status/2040481241200472150 · Twitter Post