Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.16.12. This is due to the 'process_checkout' function not properly enforcing the plan active status check when a 'change_plan_sub_id' parameter is provided. This makes it possible for authenticated attackers, with Subscriber-level access and above, to subscribe to inactive membership plans by supplying an arbitrary 'change_plan_sub_id' value in the checkout request.
INFO
Published Date :
2026-04-15T22:26:05.515Z
Last Modified :
2026-04-16T14:19:21.197Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2026-4949 vulnerability.
| Vendors | Products |
|---|---|
| Properfraction |
|
| Wordpress |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-4949.
