An authenticated user with subscriber level access or higher can manipulate the checkout process of the ProfilePress plugin by supplying a different subscription ID. A missing authorization check on the change_plan_sub_id parameter allows the attendee to reference another user's active subscription, causing the plugin to recalculate proration and credit the user with a paid lifetime membership without completing a payment. This flaw effectively lets attackers obtain paid privileges for no cost.

The vulnerability affects the WordPress "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress" by properfraction. All plugin releases up to and including version 4.16.11 are impacted.

The CVSS score of 7.1 indicates a high impact if exploited. While an EPSS score is not available, the flaw is not listed in the CISA KEV catalog, which suggests it may not yet be actively exploited in the wild. Because the exploit requires an authenticated account with subscriber or higher privileges, attackers who gain or already possess such access can easily conduct the bypass. The relatively high severity and the clear path for exploitation warrant urgent attention.