A critical authorization bypass vulnerability in the ProfilePress plugin for WordPress allows authenticated attackers to terminate the paid subscriptions of any user.

This is an Insecure Direct Object Reference (IDOR) vulnerability caused by missing ownership validation on the change_plan_sub_id parameter within the process_checkout function. Any authenticated user with Subscriber-level access or higher can exploit this flaw to manipulate subscription records belonging to other users.

The ability for unauthorized users to cancel or expire arbitrary customer subscriptions poses a severe risk to service continuity and revenue. With a CVSS score of 8.1, the high integrity and availability impact necessitates immediate attention to prevent direct financial loss and potential reputational damage caused by service disruption for paying customers.

Immediate Action: Update the ProfilePress plugin to version 4.16.12 or later, as provided by the vendor, to implement the necessary ownership validation.

Proactive Monitoring: Monitor site access logs for unusual patterns of POST requests to the ppress_process_checkout AJAX handler, particularly those originating from standard subscriber accounts.

Compensating Controls: While no direct patch is available for older versions, administrators can utilize a Web Application Firewall (WAF) to restrict unauthorized access to sensitive checkout controller endpoints.

Public Exploit Available: No (exploit_available: false)

Given the ease with which an authenticated attacker can disrupt business operations, this vulnerability must be treated with high urgency. Organizations using the ProfilePress plugin should verify their current version and apply the vendor-supplied update immediately to ensure robust authorization checks are enforced for all subscription management actions.