CVE-2026-3453

The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.11. This is due to missing ownership validation on the change_plan_sub_id parameter in the process_checkout() function. The ppress_process_checkout AJAX handler accepts a user-controlled subscription ID intended for plan upgrades, loads the subscription record, and cancels/expires it without verifying the subscription belongs to the requesting user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel and expire any other user's active subscription via the change_plan_sub_id parameter during checkout, causing immediate loss of paid access for victims.

• CWE-639

• https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.9/src/Membership/Controllers/CheckoutController.php#L237
• https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.9/src/Membership/Controllers/CheckoutController.php#L334
• https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.9/src/Membership/Controllers/CheckoutController.php#L342
• https://plugins.trac.wordpress.org/changeset/3474509/wp-user-avatar/trunk/src/Membership/Controllers/CheckoutController.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/74e4808f-bd6f-4e62-91cb-31c86a427498?source=cve

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34524SillyTavern is a locally installed user interface that allow…8.8
• CVE-2026-34525AIOHTTP is an asynchronous HTTP client/server framework for …5.3
• CVE-2026-34526SillyTavern is a locally installed user interface that allow…5
• CVE-2026-34527Sandboxie-Plus is an open source sandbox-based isolation sof…5.3
• CVE-2026-34528File Browser is a file managing interface for uploading, del…9.8
• CVE-2026-34529File Browser is a file managing interface for uploading, del…9
• CVE-2026-34530File Browser is a file managing interface for uploading, del…6.9
• CVE-2026-34531Flask-HTTPAuth provides Basic, Digest and Token HTTP authent…8.2
• CVE-2026-34532Parse Server is an open source backend that can be deployed …9.1
• CVE-2026-34533iccDEV provides a set of libraries and tools for working wit…5.5
• CVE-2026-34534iccDEV provides a set of libraries and tools for working wit…5.5
• CVE-2026-34535iccDEV provides a set of libraries and tools for working wit…5.5