CVE-2026-123656

MediumCVSS 5.3/10Last modified Nov 12, 2026

Description

The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1236575.3The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is acti CVE-2026-1236595.3The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those conf CVE-2026-123668.8Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) onc CVE-2026-1236605.3In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to CVE-2026-1236614.3The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an ex CVE-2026-1236645.4A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown CVE-2026-1236652.8A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/pr CVE-2026-1236664.9The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection CVE-2026-1236676.4The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them CVE-2026-1236685.3The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthen CVE-2026-1236704.3The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legit CVE-2026-1236758.3A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code o