Description
The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ProfilePress | < 4.17.6 | 4.17.6 |
References
- https://wpscan.com/vulnerability/9ddc7296-26be-46ca-9752-d48c88754f55/ exploit vdb-entry technical-description