CVE-2026-3445 properfraction CVE debrief

Who should care

Administrators of WordPress sites using the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin, especially those with subscriber level access and above, should be aware of this vulnerability and take necessary actions to protect their sites.

Technical summary

The vulnerability is due to a missing ownership verification on the `change_plan_sub_id` parameter in the `process_checkout()` function. This allows authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to manipulate proration calculations, enabling them to obtain paid lifetime membership plans without payment via the `ppress_process_checkout` AJAX action. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity.

Defensive priority

High priority due to the potential for financial loss and unauthorized access.

Recommended defensive actions

• Update the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin to the latest version.
• Restrict access to the `ppress_process_checkout` AJAX action.
• Monitor for suspicious activity related to membership payments.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-04-04T09:16:20.330Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify affected product deployments, review official advisories, and monitor for suspicious activity related to membership payments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.