Threats tagged 'ghsa-2vw3-fc6q-5pc2'

The ProfilePress WordPress plugin versions prior to 4.17.4 have a vulnerability where the plugin does not verify if a membership plan is still active during checkout when changing an existing subscription. This allows subscribers to subscribe to membership plans that the site owner has deactivated, including free plans that assign user roles.