CVE-2026-4949

The ProfilePress WordPress plugin version 4.16.12 and earlier contains a missing authorization vulnerability in the checkout process that allows authenticated users to bypass plan activation status checks. By manipulating the 'change_plan_sub_id' parameter, attackers with Subscriber-level access can subscribe to inactive membership plans, circumventing intended business logic and access controls. The vulnerability presents a medium severity risk (CVSS 4.3) with a network-based attack vector requiring low complexity and only user-level privileges. The impact is limited to integrity violations without affecting confidentiality or system availability. The extremely low EPSS score of 0.00035 indicates minimal likelihood of exploitation in the wild relative to other disclosed vulnerabilities. There is no evidence of active exploitation in the known exploited vulnerabilities database, and the vulnerability does not appear on any exploitation hotlists. Community attention remains low based on the moderate FAUCET risk score of 38.0 and the absence of publicly available exploit code. However, the plugin's widespread use warrants timely patching to prevent unauthorized access to premium membership features.