ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR

Description

The plugin does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.
On lifetime plans the victim's WordPress role is additionally removed, and where a payment gateway is connected the cancellation is propagated to it, making the impact difficult to reverse. Subscription IDs are sequential integers, so an attacker can enumerate and cancel every active subscription on the site.