CVE-2026-12497
Received Received - Intake

Unauthenticated Role Escalation in Paid Memberships Pro WordPress Plugin

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: WPScan

Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some valid ways of configuring the offered roles the handler ignores the restriction and falls back to accepting any non-administrator role. Combined with the absence of a nonce on the public registration handler, this allows an unauthenticated visitor to register an account with a higher role, such as Editor or Author, than the form was configured to offer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-12497
EUVD
EUVD-2026-48488

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
profilepress profilepress to 4.16.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the ProfilePress WordPress plugin before version 4.16.18. It allows unauthenticated users to register accounts with elevated privileges like Editor or Author. The issue occurs because the plugin uses separate parsers for roles offered on the registration form and roles accepted by the registration handler. In some configurations, the handler ignores role restrictions and defaults to accepting any non-administrator role. Additionally, the lack of a nonce on the public registration handler enables this exploit.

Detection Guidance

Check the installed version of the ProfilePress plugin. If it is below 4.16.18, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

An attacker could exploit this to gain unauthorized access to your WordPress site with higher privileges than intended. This could allow them to create, modify, or delete content, change site settings, or even take control of the site. The vulnerability enables privilege escalation without authentication, making it particularly dangerous for sites using the affected plugin.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for GDPR, HIPAA, and other regulations. Unauthorized privilege escalation may result in unauthorized data access, modification, or deletion, triggering legal penalties, fines, or reputational damage for non-compliance.

Mitigation Strategies

Update the ProfilePress plugin to version 4.16.18 or later immediately. If updating is not possible, disable the plugin or restrict user registration functionality until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart