{"affected":[{"defaultStatus":"unaffected","product":"ProfilePress","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.17.6","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-123657","cwes":["CWE-862"],"description":"The ProfilePress  WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/9ddc7296-26be-46ca-9752-d48c88754f55/"}],"kev":null,"metrics":[],"modifiedAt":1794376812882,"publishedAt":1794376812882,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/9ddc7296-26be-46ca-9752-d48c88754f55/"}],"remediation":[],"revision":"225e10493a950176bf2cfe9cf0ed08151b2b5b33958ff0375dabcce42a538f8b","sources":[{"modifiedAt":1794376812882,"name":"CNA: WPScan","retrievedAt":1794377421327,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123657"}],"ssvc":null,"status":"published","title":"ProfilePress < 4.17.6 - Unauthenticated Inactive Membership Plan Enrollment via Negative Plan ID","updatedAt":1794377421327}