Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Content Restriction Bypass via REST API

ID

WPSEC-2026-0400

Plugin

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (wp-user-avatar)

Affected

from 3.0 before 4.17.6

Remediation

Update to 4.17.6 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-200

Usage

Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22

Attack surface

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface

Fix released

2026-10-02

Published

2026-10-03

Description

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.5. This is due to content protection rules using the 'Home or Front Page', 'Blog or Posts Page' and 'Pages with Template' conditions checking the main query instead of the post being displayed, and the REST API search exclusion matching the raw request URI. This makes it possible for unauthenticated attackers to read restricted page content through the REST API, feeds and other listings, and to find restricted posts through REST API searches whose route is written in different letter case or encoding.

References

• https://wpsec.com/vuln/WPSEC-2026-0400/
• https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.17.6/
• https://wordpress.org/plugins/wp-user-avatar/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS