MEDIUMCVSS v3.1 4.3Vulnerability
CVE-2026-123661
The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Epss score
- 0.00168
- Cvss severity
- MEDIUM
- Cvss score
- 4.3
- Retrieved at
- 2026-11-11T23:51:13+00:00
- Last source
- FIRST EPSS
- Score
- 4.3
- Cvss version
- 3.1
- Cve id
- CVE-2026-123661
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- First seen by Signal
- 2026-11-11T07:36:44+00:00
- Name
- CVE-2026-123661
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Published at
- 2026-11-11T06:17:18.067
- Last modified
- 2026-11-11T12:19:42.753
- Epss percentile
- 0.06284
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph