Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the `change_plan_sub_id` parameter in the `process_checkout()` function. This makes it possible for authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to manipulate proration calculations, allowing them to obtain paid lifetime membership plans without payment via the `ppress_process_checkout` AJAX action.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-04 | 1 | Disclosure1 |
| 2026-04-10 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-3445-wp-user-avatar-version-4-16-11-high-vulnerability-proof-of-concept CVE-2026-3445 #WordPress plugin #vulnerability wp-user-avatar #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof‑of‑concept for CVE-2026-3445 was published, targeting WordPress wp‑user‑avatar v4.16.11, but no active exploitation or patch information was provided.
CVE-2026-3445 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthor… https://www.cve.org/CVERecord?id=CVE-2026-3445
Post summary
The text references a newly assigned CVE for a WordPress plugin, indicating a potential unauthorized access vulnerability but providing limited technical detail or remediation information.