CVE-2026-123657
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them.