Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress CVE-2026-3445

Requires authenticated WordPress user with subscriber-level access or higher to ProfilePress plugin (versions ≤4.16.11). Attacker manipulates the change_plan_sub_id parameter during checkout to reference another user's active subscription, bypassing payment verification without victim interaction needed.

The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-exploitable attacks with low complexity requiring only low-privilege authentication (subscriber role, the default for registered users on WordPress). The 7.1 score (High severity) with High Integrity impact reflects the ability to bypass payment controls entirely. Real-world risk is significant for revenue-generating sites: any authenticated user can escalate to premium memberships without payment, directly impacting business operations. The low privilege requirement (PR:L) means the attack surface includes all registered users, not just trusted accounts. Attack complexity is low (AC:L) with no user interaction needed (UI:N), making exploitation straightforward once the vulnerable endpoint is identified. While no public exploit identified at time of analysis, the technical details from Wordfence's disclosure and the available patch changeset provide sufficient information for capable attackers to develop exploits. The vulnerability is not in CISA KEV, suggesting no confirmed widespread exploitation, but the financial incentive for abuse and low technical barriers warrant treating this as high-priority for affected sites. SSVC assessment: exploitation status unclear, likely automatable given AJAX endpoint nature, high technical impact (financial fraud), making this a priority remediation candidate.

An attacker registers a free subscriber account on a WordPress site running ProfilePress 4.16.11. They identify the subscription ID of a legitimate paying user with an active membership by monitoring AJAX traffic or enumerating sequential IDs. When initiating checkout for a paid lifetime membership plan through the ppress_process_checkout AJAX endpoint, the attacker includes the change_plan_sub_id parameter referencing the victim's active subscription. The plugin's proration calculation logic processes this as a legitimate plan change rather than a new purchase, allowing the attacker to obtain the premium lifetime membership without payment. The attacker can repeat this process to create multiple premium accounts or resell access, causing direct revenue loss to the site operator.