The vulnerability stems from an insecure direct object reference in the ProfilePress plugin, whereby the AJAX handler for process_checkout() accepts a user-provided subscription ID via the change_plan_sub_id parameter. Key detail from the CVE description: the handler loads the subscription record and cancels or expires it without verifying that the subscription belongs to the requesting user. This flaw enables an authenticated user with Subscriber level or higher privileges to terminate or expire any other user's active subscription, resulting in immediate loss of paid access to the victim.

The flaw affects all releases of the ProfilePress Paid Membership Plugin up to and including version 4.16.11, provided by the vendor properfraction. The plugin delivers ecommerce, user registration, login, profile, and restricted content functionality and is used within WordPress installations.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests a low exploitation probability. The issue is not listed in CISA’s KEV catalog. Attack requires an authenticated WordPress user with Subscriber or higher privileges and involves manipulating the change_plan_sub_id input during the checkout process. While the attack vector is contained to authenticated accounts, the impact is significant—any user’s subscription can be revoked, essentially causing a denial of service to the affected subscriber.