Vulnerabilities / Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content / WPSEC-2026-0404
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Brute Force Protection Bypass
Medium 4.8
CWE-307Fixed in 4.17.6
- ID
- WPSEC-2026-0404
- Plugin
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (wp-user-avatar)
- Affected
- from 3.2.12 before 4.17.6
- Remediation
- Update to 4.17.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface
- Fix released
- Published
Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to a brute force protection bypass in all versions up to, and including, 4.17.5. This is due to the plugin's login handler removing every callback attached to the wp_login_failed action before authenticating. This makes it possible for unauthenticated attackers to make unlimited password guesses through the plugin's login forms and login AJAX action without the failures being recorded by brute force protection plugins that rely on that action.
References
- https://wpsec.com/vuln/WPSEC-2026-0404/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.17.6/
- https://wordpress.org/plugins/wp-user-avatar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS