The ProfilePress plugin for WordPress has a missing authorization check in its process_checkout method. When an authenticated user supplies an arbitrary change_plan_sub_id value in the checkout request, the plugin does not verify that the selected plan is active before creating the subscription. This flaw allows a Subscriber or higher level user to enroll in a membership plan that is marked inactive, potentially gaining access to privileges or triggering unintended billing for content that should not be available. This is a CWE-862: Missing Authorization.

All releases of the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin up to and including version 4.16.12 are affected. WordPress sites that have installed any of those versions are vulnerable. The CVE model does not identify a version that contains the authorization fix.

The CVSS base score of 4.3 indicates moderate severity. The vulnerability requires authenticated access at the Subscriber level or higher, reducing the likelihood of widespread exploitation. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The attacker can exploit the vulnerability by sending a crafted checkout request to the plugin's endpoint with a change_plan_sub_id parameter after authenticating with a genuine account, creating a subscription to an inactive plan immediately.