CVE-2026-123656

{
  "etk_id": "ETK-2026-4148",
  "cve_id": "CVE-2026-123656",
  "display_id": "CVE-2026-123656",
  "ghsa_id": "GHSA-pgcv-pw6q-4vjj",
  "euvd_id": "EUVD-2026-123194",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Content protection bypass in ProfilePress",
  "summary": "ProfilePress versions earlier than 4.17.6 may not enforce certain content-protection rules when protected material is handled outside the main WordPress query. An unauthenticated remote user could access affected protected pages through the REST API when those rule conditions are in use.",
  "mitigation": "Upgrade ProfilePress to version 4.17.6 or later. Until upgrading, restrict REST API access where operationally feasible and review pages protected by the affected rule configurations.",
  "vendor": null,
  "product": "ProfilePress",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 4.17.6"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.17.6"
      ],
      "package_name": "ProfilePress",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 28.3339045,
  "t0_at": "2026-11-11T06:00:12.711000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-11T07:45:53.564775+00:00",
      "days": 0.07338951128472222,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T06:00:12.711000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-11-11T07:45:53.564775+00:00",
      "days": 0.07338951128472222,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T06:00:12.711000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-11T06:00:12.711000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T06:00:12.711000+00:00",
      "url": "https://github.com/advisories/GHSA-pgcv-pw6q-4vjj"
    }
  }
}