What is the CVSS score of CVE-2026-3453?

CVE-2026-3453 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3453?

WordPress sites running ProfilePress plugin (versions up to 4.16.11) are vulnerable to unauthorized subscription manipulation, allowing attackers to cancel or modify other users' subscriptions…

How to fix or mitigate CVE-2026-3453?

Within 24 hours: Audit all ProfilePress installations and document affected versions; disable the plugin if not business-critical or restrict access to trusted users only. Within 7 days: Monitor AJAX logs for suspicious ppress_process_checkout requests; implement Web Application Firewall rules to block unauthorized subscription parameter manipulation. Within 30 days: Contact ProfilePress vendor for patch availability; prepare migration plan to alternative plugin or custom solution; test and deploy patch immediately upon release.

WordPress CVE-2026-3453

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-11 security@wordfence.com

WordPress Authentication Bypass

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 03:15 nvd

HIGH 8.1

DescriptionCVE.org

The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.11. This is due to missing ownership validation on the change_plan_sub_id parameter in the process_checkout() function. The ppress_process_checkout AJAX handler accepts a user-controlled subscription ID intended for plan upgrades, loads the subscription record, and cancels/expires it without verifying the subscription belongs to the requesting user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel and expire any other user's active subscription via the change_plan_sub_id parameter during checkout, causing immediate loss of paid access for victims.

AnalysisAI

Authenticated users can terminate arbitrary subscriptions in WordPress ProfilePress plugin versions up to 4.16.11 through an IDOR vulnerability in the checkout process that lacks ownership validation on subscription IDs. Any subscriber-level user can exploit the change_plan_sub_id parameter to cancel or expire other users' active subscriptions, immediately revoking their paid access. The vulnerability remains unpatched and affects all current versions of the plugin.

Technical ContextAI

This vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) exists in the change_plan_sub_id component. The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.11. This is due to missing ownership validation on the change_plan_sub_id parameter in the process_checkout() function. The ppress_process_checkout AJAX handler accepts a user-controlled subscription ID intended for plan upgrades, loads the subscription record, and cancels/expires it without verifying the subscription belongs to the requesting user. This makes it pos