Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.16.12. This is due to the 'process_checkout' function not properly enforcing the plan active status check when a 'change_plan_sub_id' parameter is provided. This makes it possible for authenticated attackers, with Subscriber-level access and above, to subscribe to inactive membership plans by supplying an arbitrary 'change_plan_sub_id' value in the checkout request.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-4949 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing … https://www.cve.org/CVERecord?id=CVE-2026-4949
Post summary
The statement merely references CVE‑2026‑4949 with a URL and a brief, incomplete description, lacking substantive details on the vulnerability, exploitation, or remediation.
CVE-2026-4949 Missing Authorization in ProfilePress Plugin for WordPress Version... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4949 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The text announces CVE-2026-4949 as a missing authorization flaw in the ProfilePress WordPress plugin, serving as a basic disclosure without detailed technical information, a PoC, or exploitation evidence.