CVE-2026-3445: CWE-862 Missing Authorization in properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the `change_plan_sub_id` parameter in the `process_checkout()` function. This makes it possible for authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to manipulate proration calculations, allowing them to obtain paid lifetime membership plans without payment via the `ppress_process_checkout` AJAX action.
AI Analysis
Technical Summary
CVE-2026-3445 is a missing authorization vulnerability (CWE-862) in the ProfilePress Paid Membership Plugin for WordPress. The flaw exists because the process_checkout() function does not verify ownership of the change_plan_sub_id parameter. Authenticated attackers with subscriber-level privileges can exploit this by referencing another user's active subscription during checkout, manipulating proration calculations to obtain paid lifetime memberships without payment through the ppress_process_checkout AJAX action. This vulnerability affects all versions up to 4.16.11 and has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Potential Impact
An attacker with subscriber-level access can bypass payment controls to gain unauthorized paid lifetime membership plans, impacting the integrity of the membership system. Confidentiality is partially impacted due to the ability to reference other users' subscriptions. There is no impact on availability. This could lead to financial loss for site operators and unauthorized access to premium content.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting subscriber-level access or disabling the affected AJAX action if possible. Monitor vendor channels for updates and apply patches promptly once available.
CVE-2026-3445: CWE-862 Missing Authorization in properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the `change_plan_sub_id` parameter in the `process_checkout()` function. This makes it possible for authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to manipulate proration calculations, allowing them to obtain paid lifetime membership plans without payment via the `ppress_process_checkout` AJAX action.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-3445 is a missing authorization vulnerability (CWE-862) in the ProfilePress Paid Membership Plugin for WordPress. The flaw exists because the process_checkout() function does not verify ownership of the change_plan_sub_id parameter. Authenticated attackers with subscriber-level privileges can exploit this by referencing another user's active subscription during checkout, manipulating proration calculations to obtain paid lifetime memberships without payment through the ppress_process_checkout AJAX action. This vulnerability affects all versions up to 4.16.11 and has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Potential Impact
An attacker with subscriber-level access can bypass payment controls to gain unauthorized paid lifetime membership plans, impacting the integrity of the membership system. Confidentiality is partially impacted due to the ability to reference other users' subscriptions. There is no impact on availability. This could lead to financial loss for site operators and unauthorized access to premium content.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting subscriber-level access or disabling the affected AJAX action if possible. Monitor vendor channels for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-03-02T15:39:16.791Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d0cfab0a160ebd92dd86d0
Added to database: 4/4/2026, 8:45:31 AM
Last enriched: 4/11/2026, 12:52:02 PM
Last updated: 5/21/2026, 7:11:04 PM
Views: 169
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.