Vulnerability · Published Jun 27, 2026 · Assigned by WPScan

CVE-2026-10820ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR

High 8.1

In plain English

A high-severity security flaw in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 68.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content	0 – before 4.16.17

References

https://wpscan.com/vulnerability/cb7ad514-e0d5-4ff3-803a-918cdc194f39/ exploit, vdb-entry, technical-description