CVE-2026-3445: ProfilePress Plugin Auth Bypass Flaw

CVE-2026-3445 Overview

CVE-2026-3445 is a critical authorization bypass vulnerability discovered in the ProfilePress plugin for WordPress, a popular membership and e-commerce solution. The vulnerability exists in the process_checkout() function, which fails to properly verify ownership of the change_plan_sub_id parameter. This missing authorization check allows authenticated attackers with minimal privileges (subscriber level or above) to manipulate proration calculations during checkout by referencing another user's active subscription, ultimately obtaining paid lifetime membership plans without making any payment.

Critical Impact

Authenticated attackers can obtain paid lifetime membership plans for free by exploiting the missing ownership verification in the checkout process, leading to significant financial losses for affected site owners.

Affected Products

• ProfilePress (wp-user-avatar) WordPress plugin versions up to and including 4.16.11
• WordPress sites using ProfilePress for paid membership functionality
• E-commerce implementations relying on ProfilePress subscription management

Discovery Timeline

• April 4, 2026 - CVE-2026-3445 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3445

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a critical flaw where the application fails to perform proper access control checks before executing sensitive operations. In the context of ProfilePress, the process_checkout() function processes membership purchases and subscription changes but does not validate whether the current user owns the subscription referenced in the change_plan_sub_id parameter.

The attack exploits the proration calculation logic that determines pricing adjustments when users change between membership plans. By supplying a valid subscription ID belonging to another user who has a higher-value active subscription, an attacker can manipulate the proration math to reduce or eliminate the payment required for premium membership plans.

Root Cause

The root cause of this vulnerability is the absence of ownership verification in the checkout flow. When processing the ppress_process_checkout AJAX action, the application accepts a change_plan_sub_id parameter that references subscription records in the database. The code retrieves subscription details and uses them for proration calculations without confirming that the subscription belongs to the authenticated user making the request. This allows any authenticated user to reference any subscription ID in the system, gaining illegitimate pricing advantages.

Attack Vector

The attack is network-accessible and requires only basic authentication (subscriber-level access). An attacker would first need to identify valid subscription IDs belonging to other users with active paid memberships. This can potentially be achieved through predictable ID enumeration or information disclosure vulnerabilities. Once a valid subscription ID is obtained, the attacker initiates a checkout for a premium lifetime membership plan while injecting the victim's subscription ID into the change_plan_sub_id parameter via the ppress_process_checkout AJAX endpoint.

The malicious proration calculation then credits the attacker's checkout with the value of the victim's subscription, potentially reducing the payment amount to zero. The attacker completes checkout and receives the premium membership without legitimate payment.

Detection Methods for CVE-2026-3445

Indicators of Compromise

• Unusual patterns in membership purchase logs showing $0 or heavily discounted lifetime plan acquisitions
• Multiple checkout attempts from single users with varying change_plan_sub_id values
• New premium memberships associated with accounts that lack corresponding payment records
• Subscription ID references in checkout logs that don't match the authenticated user

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and flag suspicious patterns in ppress_process_checkout AJAX requests
• Enable WordPress audit logging to track all membership plan changes and payment events
• Configure alerts for lifetime membership purchases that complete without corresponding payment gateway confirmations
• Review access logs for sequential or brute-force patterns targeting subscription ID enumeration

Monitoring Recommendations

• Monitor ProfilePress checkout events for mismatches between authenticated user IDs and referenced subscription owners
• Set up anomaly detection for membership revenue that deviates significantly from expected payment amounts
• Implement real-time alerting on high-value membership plan activations for immediate review
• Regularly audit membership records to identify accounts with premium access but missing payment histories

How to Mitigate CVE-2026-3445

Immediate Actions Required

• Update ProfilePress to the latest patched version immediately (versions after 4.16.11)
• Audit existing membership records to identify any potentially fraudulent premium memberships obtained without payment
• Temporarily disable the plan change functionality if immediate patching is not possible
• Review recent checkout logs for suspicious activity patterns

Patch Information

The ProfilePress development team has addressed this vulnerability in plugin updates following version 4.16.11. The fix implements proper ownership verification for the change_plan_sub_id parameter, ensuring users can only reference their own subscriptions during checkout operations. Detailed changeset information is available in the WordPress Plugin Changeset. Additional vulnerability details can be found in the Wordfence Vulnerability Report.

Workarounds

• If patching is not immediately possible, restrict access to the checkout functionality to trusted user roles only
• Implement server-side validation at the web server or WAF level to reject checkout requests with change_plan_sub_id values that don't match the authenticated user
• Consider temporarily disabling proration features until the patch can be applied
• Enable additional payment verification steps that require manual approval for high-value membership purchases

# WordPress CLI command to update ProfilePress plugin
wp plugin update wp-user-avatar --path=/var/www/html

# Verify the updated version
wp plugin get wp-user-avatar --field=version --path=/var/www/html