PeproDev Ultimate Profile Solutions <= 8.3.0 - Authenticated (Subscriber+) Missing Authorization to Restricted Announcement Access
- ID
- WPSEC-2026-2653
- Plugin
- PeproDev Ultimate Profile Solutions (peprodev-ups)
- Affected
- all versions before 8.3.20
- Remediation
- Update to 8.3.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- PeproDev Ultimate Profile Solutions on WPSec AttackSurface
- Fix released
- Published
Description
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via announcements in all versions up to, and including, 8.3.0, due to flawed logic in the user_has_access_to_annoncment() function. The function starts from access granted and leaves its group and LearnDash course loops before checking anything, so announcements restricted to Groups or LearnDash courses are treated as open to everyone. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read announcements restricted to groups or courses they do not belong to.
References
- https://wpsec.com/vuln/WPSEC-2026-2653/
- https://plugins.svn.wordpress.org/peprodev-ups/tags/8.3.20/
- https://wordpress.org/plugins/peprodev-ups/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS