CVE-2026-3453 is an insecure direct object reference vulnerability (CWE-639) in the ProfilePress WordPress plugin affecting all versions up to 4.16.11. The vulnerability arises from missing ownership validation on the change_plan_sub_id parameter in the ppress_process_checkout AJAX handler. This handler accepts a user-controlled subscription ID intended for plan upgrades but fails to verify that the subscription belongs to the requesting user before canceling or expiring it. Consequently, an authenticated attacker with at least Subscriber-level privileges can cancel or expire any other user's active subscription during checkout, causing denial of paid membership access.

Exploitation allows authenticated users with Subscriber-level or higher privileges to cancel or expire subscriptions belonging to other users. This results in immediate loss of paid membership access for the victims. The vulnerability does not disclose sensitive data but impacts integrity and availability of subscription services. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access if possible and monitor for suspicious subscription cancellations. Avoid using vulnerable versions of the ProfilePress plugin. Follow vendor updates closely for an official patch or temporary mitigation instructions.