What is the CVSS score of CVE-2026-3445?

CVE-2026-3445 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3445?

ProfilePress WordPress plugin versions 4.16.11 and earlier contain a subscription hijacking vulnerability that allows authenticated subscribers to obtain lifetime membership plans without payment,…

How to fix or mitigate CVE-2026-3445?

Within 24 hours: Identify all WordPress instances running ProfilePress and document current versions via admin dashboard or wp-cli. Within 7 days: Update ProfilePress to version 4.16.12 or later on all affected installations; test membership checkout workflows in staging environment before production deployment. Within 30 days: Audit subscription records from the past 90 days for anomalies (lifetime plans activated without payment records), contact affected customers if fraud detected, and implement transaction logging/alerting for subscription state changes.

WordPress CVE-2026-3445

EUVD-2026-18987 HIGH

Missing Authorization (CWE-862)

2026-04-04 Wordfence

WordPress Authentication Bypass

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 04, 2026 - 08:45 euvd

EUVD-2026-18987

Analysis Generated

Apr 04, 2026 - 08:45 vuln.today

CVE Published

Apr 04, 2026 - 08:25 nvd

HIGH 7.1

DescriptionCVE.org

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the change_plan_sub_id parameter in the process_checkout() function. This makes it possible for authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to manipulate proration calculations, allowing them to obtain paid lifetime membership plans without payment via the ppress_process_checkout AJAX action.

AnalysisAI

Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordPress plugin (≤4.16.11) without payment by exploiting a missing ownership verification flaw. The vulnerability allows hijacking of another user's active subscription during checkout to manipulate proration calculations. With a 7.1 CVSS score, low attack complexity, and requiring only low-privilege authentication, this presents a significant revenue loss risk for sites using ProfilePress for paid memberships. No public exploit identified at time of analysis, though EPSS data not available. Vendor patch released in version 4.16.12.

Technical ContextAI

ProfilePress (CPE: cpe:2.3:a:properfraction:paid_membership_plugin,_ecommerce,_user_registration_form,_login_form,_user_profile_&_restrict_content_-_profilepress) is a comprehensive WordPress membership and user management plugin supporting paid subscriptions and ecommerce functionality. The vulnerability stems from CWE-862 (Missing Authorization) in the process_checkout() function's handling of the change_plan_sub_id parameter. When processing checkout via the ppress_process_checkout AJAX action, the plugin fails to verify that the subscription ID being referenced actually belongs to the authenticated user making the request. This broken object-level authorization (BOLA) flaw allows attackers to reference arbitrary active subscription IDs from other users, manipulating the proration calculation logic intended for legitimate plan changes. The plugin's checkout process incorrectly trusts client-supplied subscription references without backend ownership validation, a common authorization bypass pattern in subscription management systems.

RemediationAI

Vendor-released patch: Update ProfilePress to version 4.16.12 or later, which addresses the missing ownership verification in the process_checkout() function. The fix is available via the WordPress plugin repository as detailed in the changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3474509%40wp-user-avatar%2Ftrunk&old=3473639%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=#file3. Site administrators should update immediately through the WordPress admin dashboard (Plugins > Updates) or manually download from the official repository. As an interim mitigation if immediate patching is not possible, consider temporarily disabling new membership registrations or the checkout functionality until the update can be applied. Review recent subscription activations for anomalous patterns such as lifetime memberships created by subscriber-level accounts or multiple premium upgrades without corresponding payment records. Consult the full Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ae1e198b-0c0d-47aa-8a56-ec4e790c8022 for additional context.