An Insecure Direct Object Reference in the ProfilePress plugin before version 4.16.17 allows an authenticated user with Subscriber other user’s subscription. The plugin does not verify ownership of the target subscription before performing the cancellation, enabling an attacker to terminate active plans belonging to other users.

ProfilePress WordPress plugin for paid memberships, e-commerce, user registration, login, user profile, and content restriction. Versions prior to 4.16.17 are affected.

This vulnerability exposes users to unauthorized cancellation of their active subscriptions, which can disrupt service availability and cause financial loss to the site owner. The risk is significant for sites that rely on subscription revenue. Exploitation can be achieved by any authenticated user with a Subscriber+ role, by simply supplying the identifier of another user’s subscription to the cancellation endpoint. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. No CVSS score is provided, but the impact on business continuity and revenue suggests a high severity.