{"api_version":"1","generated_at":"2026-11-11T07:19:39+00:00","cve":"CVE-2026-123656","urls":{"html":"https://cve.report/CVE-2026-123656","api":"https://cve.report/api/cve/CVE-2026-123656.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-123656","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-123656"},"summary":{"title":"ProfilePress < 4.17.6 - Unauthenticated Restricted Content Disclosure via REST API","description":"The ProfilePress  WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-11 06:17:17","updated_at":"2026-11-11 06:17:17"},"problem_types":["CWE-284 Improper Access Control"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/5a670095-e8c7-4317-a929-a896d01ee648/","name":"https://wpscan.com/vulnerability/5a670095-e8c7-4317-a929-a896d01ee648/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123656","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123656","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"ProfilePress","version":"affected 4.17.6 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"an7ln","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"ProfilePress","vendor":"Unknown","versions":[{"lessThan":"4.17.6","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"an7ln"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The ProfilePress  WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API."}],"problemTypes":[{"descriptions":[{"description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T06:00:12.711Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/5a670095-e8c7-4317-a929-a896d01ee648/"}],"source":{"discovery":"EXTERNAL"},"title":"ProfilePress < 4.17.6 - Unauthenticated Restricted Content Disclosure via REST API","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-123656","datePublished":"2026-11-11T06:00:12.711Z","dateReserved":"2026-11-06T08:52:41.287Z","dateUpdated":"2026-11-11T06:00:12.711Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-11 06:17:17","lastModifiedDate":"2026-11-11 06:17:17","problem_types":["CWE-284 Improper Access Control"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"123656","Ordinal":"1","Title":"ProfilePress < 4.17.6 - Unauthenticated Restricted Content Discl","CVE":"CVE-2026-123656","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"123656","Ordinal":"1","NoteData":"The ProfilePress  WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.","Type":"Description","Title":"ProfilePress < 4.17.6 - Unauthenticated Restricted Content Discl"}]}}}