# PeproDev Ultimate Profile Solutions <= 8.3.0 - Authenticated (Subscriber+) Missing Authorization to Restricted Announcement Access

- **ID:** WPSEC-2026-2653
- **Plugin:** PeproDev Ultimate Profile Solutions (`peprodev-ups`), https://wordpress.org/plugins/peprodev-ups/
- **Affected versions:** all versions before 8.3.20
- **Fixed in:** 8.3.20 (Update to 8.3.20 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/peprodev-ups
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2653/

## Description

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via announcements in all versions up to, and including, 8.3.0, due to flawed logic in the user_has_access_to_annoncment() function. The function starts from access granted and leaves its group and LearnDash course loops before checking anything, so announcements restricted to Groups or LearnDash courses are treated as open to everyone. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read announcements restricted to groups or courses they do not belong to.

## References

- https://wpsec.com/vuln/WPSEC-2026-2653/
- https://plugins.svn.wordpress.org/peprodev-ups/tags/8.3.20/
- https://wordpress.org/plugins/peprodev-ups/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2653/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.