Subscriber+ Subscription Cancellation via IDOR

Summary

ProfilePress (< 4.16.17) does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users’ active subscriptions via an Insecure Direct Object Reference (IDOR).

On lifetime plans the victim’s WordPress role is additionally removed, and where a payment gateway is connected the cancellation is propagated to it. Subscription IDs are sequential integers, allowing automated bulk cancellation.