# CVE-2026-123657: ProfilePress WordPress plugin access control bypass via negative plan ID

Source: https://junglewise.ai/threats/cve-2026-123657-the-profilepress-wordpress-plugin-before-4-17-6-does-not-reject  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-123657 · Severity: info · Published 2026-11-11

ProfilePress is a membership management plugin for WordPress that controls user signup and role assignment. Unauthenticated attackers can exploit a flaw in plan identifier validation to enroll in deactivated membership plans and receive administrative roles they should not have access to.

Technologies: [ProfilePress](https://junglewise.ai/threats/technologies/profilepress). Vendors: [ProfilePress](https://junglewise.ai/threats/vendors/profilepress).

## Quick answers

**Is CVE-2026-123657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123657 being exploited in the wild.

**How severe is CVE-2026-123657?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** ProfilePress before 4.17.6.

**Is there a fix for CVE-2026-123657?** Yes: fixed in 4.17.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123657 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123657?** Check whether you run ProfilePress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.17.6

## Technical details

The plugin fails to reject negative membership plan identifiers before validating whether a plan is active, allowing an attacker to bypass plan status checks. An unauthenticated user can supply a negative plan ID to sign up for deactivated plans and receive associated roles. This is a broken access control vulnerability (CWE-862) with no authentication required.

## Affected products

- ProfilePress ProfilePress before 4.17.6

## Timeline

- 2026-11-09: disclosed
- 2026-11-11: advisory

## References

- [https://wpscan.com/vulnerability/9ddc7296-26be-46ca-9752-d48c88754f55/](https://wpscan.com/vulnerability/9ddc7296-26be-46ca-9752-d48c88754f55/)

## Related threats

- [ProfilePress WordPress plugin missing authorization in checkout membership plan change](https://junglewise.ai/threats/cve-2026-123661-the-profilepress-wordpress-plugin-before-4-17-4-does-not-check)
- [ProfilePress WordPress plugin access control bypass via REST API](https://junglewise.ai/threats/cve-2026-123656-the-profilepress-wordpress-plugin-before-4-17-6-does-not)
- [ProfilePress reflected XSS in file upload filename parameter](https://junglewise.ai/threats/cve-2026-92551-the-paid-membership-plugin-ecommerce-user-registration-form-login)
- [ProfilePress plugin for WordPress sensitive information exposure](https://junglewise.ai/threats/cve-2026-92536-the-paid-membership-plugin-ecommerce-user-registration-form-login)
- [ProfilePress arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-85658-the-paid-membership-plugin-ecommerce-user-registration-form-login)