Platform
wordpress
Component
wp-user-avatar
Fixed in
4.16.12
CVE-2026-3445 is a security vulnerability affecting the ProfilePress plugin for WordPress, a popular tool for membership management, ecommerce, and user registration. This flaw allows authenticated attackers with subscriber access or higher to manipulate proration calculations during checkout by referencing another user's subscription, potentially leading to unauthorized access to paid features. The vulnerability impacts versions 0.0.0 through 4.16.11, but a patch is available in version 4.16.12.
CVE-2026-3445 in the ProfilePress WordPress plugin allows authenticated attackers, with subscriber level access or higher, to bypass membership payments. This is due to a missing ownership verification on the changeplansubid parameter within the processcheckout() function. An attacker could, for example, modify the request to use another user's sub_id, allowing them to access a membership plan they haven't paid for. The impact is significant, compromising the integrity of the payment system and potentially leading to financial losses for website owners, as well as unauthorized access to restricted content.
An attacker with subscriber or higher access on a website using the ProfilePress plugin can exploit this vulnerability. The attacker needs to be able to intercept or modify HTTP requests to the processcheckout() function. This could be achieved through a man-in-the-middle attack, injecting malicious code into the website, or using browser developer tools to modify requests. Once the attacker has modified the request to include another user's subid, they can perform a plan change without making the corresponding payment, gaining unauthorized access to restricted content or functionalities.
Exploit Status
EPSS
0.03% (8% percentile)
CISA SSVC
CVSS Vector
The solution to this vulnerability is to update the ProfilePress plugin to version 4.16.12 or higher. This update includes proper ownership verification for the changeplansub_id parameter, preventing unauthorized manipulation. It is strongly recommended that all users of the plugin apply this update as soon as possible to mitigate the risk of exploitation. Additionally, review your website logs for suspicious activity that may indicate prior exploitation attempts before the update. Implementing additional security measures, such as limiting database access and monitoring network traffic, can also help protect your website.
Update to version 4.16.12, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
ProfilePress is a popular WordPress plugin that allows you to create registration forms, login forms, user profiles, and restrict content.
If you are using a version of the ProfilePress plugin older than 4.16.12, you are vulnerable to this vulnerability.
Immediately update to version 4.16.12 or higher. Review your website logs for suspicious activity and consider changing user passwords.
There is no viable temporary workaround. Updating to version 4.16.12 or higher is the only way to fully mitigate the risk.
You can find more information about this vulnerability in the CVE vulnerability database (CVE-2026-3445) and on the ProfilePress plugin website.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.