CVE-2026-3445: 
WordPress vulnerability analysis and mitigation

CVE-2026-3445 is a missing authorization vulnerability in the ProfilePress (Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content) plugin for WordPress. It affects all versions up to and including 4.16.11, allowing authenticated attackers with subscriber-level access or above to bypass payment and obtain paid lifetime membership plans for free. The vulnerability was published on April 4, 2026, and assigned a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Wordfence).

The root cause is a missing ownership verification (CWE-862) on the change_plan_sub_id parameter within the process_checkout() function of the ProfilePress plugin. An authenticated attacker can supply another user's active subscription ID in this parameter during checkout, causing the plugin to use that subscription as a reference for proration calculations. By manipulating these calculations, the attacker can reduce the effective cost of a paid lifetime membership plan to zero, completing the transaction without actual payment via the ppress_process_checkout AJAX action. Exploitation requires only a valid WordPress account with subscriber-level privileges or higher, and no user interaction from a victim is needed (GitHub Advisory, Wordfence).

Successful exploitation allows authenticated attackers to obtain paid lifetime membership plans without completing payment, directly causing financial/revenue loss for site operators and granting unauthorized access to premium content or features. The integrity impact is high, as subscription and payment records are manipulated; confidentiality impact is low, as some subscription data belonging to other users may be referenced. Availability is not affected. The vulnerability is scoped to the affected WordPress site and does not inherently enable lateral movement beyond the application (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.025% (1st percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation does require a valid authenticated account on the target WordPress site, which somewhat limits the attack surface.

1. Reconnaissance: Identify WordPress sites running the ProfilePress plugin (versions ≤ 4.16.11) by checking plugin metadata, readme files, or using tools like WPScan.
2. Account Registration: Register or obtain a subscriber-level (or higher) account on the target WordPress site.
3. Identify a Target Subscription: Enumerate or guess the subscription ID (change_plan_sub_id) of another user's active paid subscription. This may be possible through observable patterns in subscription IDs or by referencing one's own prior subscription.
4. Craft Malicious Checkout Request: Initiate a checkout for a paid lifetime membership plan and intercept the AJAX request to ppress_process_checkout. Inject the target subscription's ID into the change_plan_sub_id parameter.
5. Manipulate Proration: The plugin's process_checkout() function uses the referenced subscription for proration calculations without verifying ownership, resulting in a zero or negligible payment amount.
6. Complete Checkout: Submit the manipulated request to obtain the paid lifetime membership plan without actual payment (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to the ppress_process_checkout AJAX action (/wp-admin/admin-ajax.php?action=ppress_process_checkout) with unusual or cross-user change_plan_sub_id parameter values.
• Application Data: Subscription records in the WordPress database showing lifetime membership plans activated with zero or anomalously low payment amounts, especially for recently registered accounts.
• Application Data: Multiple checkout completions by the same user account referencing different subscription IDs not belonging to that user.
• Logs: Payment/order logs in ProfilePress showing completed orders with $0 or near-zero totals for premium lifetime plans (Wordfence).

Site administrators should upgrade the ProfilePress plugin to a version higher than 4.16.11 as soon as a patched release is available; the fix involves adding ownership verification to the change_plan_sub_id parameter in process_checkout() (WordPress Trac). As an interim workaround, consider temporarily disabling the ability for users to change subscription plans, or restricting access to the ppress_process_checkout AJAX action. Administrators should audit existing subscription and payment records for anomalous zero-cost lifetime plan activations and review all accounts with subscriber-level access or above for unauthorized membership upgrades (Wordfence).

The vulnerability was reported and disclosed by Wordfence, which maintains the threat intelligence entry for this CVE. It was picked up by automated security aggregators including RedPacket Security and shared on Mastodon by security community accounts shortly after disclosure. No notable independent researcher commentary or significant media coverage beyond standard CVE aggregation has been identified (Wordfence).