WordPress Plugin Vulnerabilities

ProfilePress < 4.17.6 - Unauthenticated Restricted Content Disclosure via REST API

Description

The plugin does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.

Proof of Concept

Affects Plugins

Plugin icon
wp-user-avatar
Fixed in 4.17.6

References

CVE
CVE-2026-123656

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
an7ln
Submitter
an7ln
Submitter website
https://qqyln.cn
Submitter twitter
zywih
Verified
Yes
WPVDB ID
5a670095-e8c7-4317-a929-a896d01ee648

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-09 (about 1 day ago)

Other

Published
Title
Published
2026-09-02
Title
Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API
Published
2026-11-06
Title
BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation
Published
2021-08-23
Title
Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update
Published
2026-07-24
Title
Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated Arbitrary Account Creation