CVE-2026-123659

ProfilePress authorization bypass in member directory filters

medium · 5.3

Fix listed

ProfilePress

Published Nov 11, 2026, 07:33 UTC

Description

The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users.

Reported fixed versions

4.17.6

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.