MEDIUMCVSS v3.1 5.3Vulnerability
CVE-2026-123659
The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Epss score
- 0.00309
- Cvss score
- 5.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-11T23:51:13+00:00
- Score
- 5.3
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-123659
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-11T11:39:15+00:00
- Name
- CVE-2026-123659
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-11-11T08:17:17.713
- Last modified
- 2026-11-11T12:19:42.623
- Epss percentile
- 0.24031
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph