Description

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The partial mitigation introduced via strip_shortcodes() on [profile-first-name] and [profile-last-name] can be bypassed through the [profile-display-name format="first_last_names"] render path, the [profile-bio] render path (which re-fetches the raw description meta), and the double-bracket escape sequence [[tag]], all of which allow attacker-controlled shortcode text to reach the outer do_shortcode() call.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-16T05:16:48.170Z",
  "pubdate": "2026-08-16T05:16:48.170Z",
  "executiveSummary": "The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution due to improper validation of values prior to invoking the do_shortcode function.\nThis security flaw impacts all versions up to, and including, 4.16.19.\nThe vulnerability allows authenticated attackers possessing subscriber-level access and above to execute arbitrary shortcodes within the application context.\nRisk implications include potential privilege escalation, data exposure, or execution of malicious shortcode payloads that may be processed by other vulnerable plugins or themes installed on the WordPress instance.\nExploitation requires authenticated access with at least subscriber-level privileges, successfully bypassing partial mitigations implemented via strip_shortcodes through alternative render paths and escape sequence manipulation.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and sanitization before passing user-controlled data to the WordPress do_shortcode() execution engine.\nThe affected component involves user profile rendering paths within the ProfilePress plugin, specifically affecting shortcodes such as [profile-first-name], [profile-last-name], [profile-display-name], and [profile-bio].\nAlthough a partial mitigation was introduced utilizing strip_shortcodes() on specific profile fields, this defensive measure is fundamentally flawed and can be systematically bypassed.\nAttackers can bypass the strip_shortcodes() restriction through the [profile-display-name format=\"first_last_names\"] render path, the [profile-bio] render path which re-fetches raw description metadata directly from the database, and the double-bracket escape sequence [[tag]] syntax.\nThese bypass vectors permit attacker-controlled shortcode text to successfully reach the outer do_shortcode() call without being sanitized or neutralized.\nThe attack flow proceeds as follows: an authenticated user with subscriber-level privileges crafts malicious input containing arbitrary shortcodes embedded within supported profile fields or parameters. Upon submission, the input traverses the vulnerable profile rendering mechanisms, bypassing the strip_shortcodes() filters via alternate paths like [profile-bio] or double-bracket syntax. The raw or improperly filtered string is subsequently processed by do_shortcode(), leading to the execution of unintended shortcode functionality.\nAffected versions include all plugin iterations up to, and including, version 4.16.19.\nAuthentication and privilege requirements mandate that the threat actor possesses at least a subscriber-level account on the target WordPress installation.\nPost-exploitation impact depends heavily on the presence of other vulnerable shortcode handlers registered within the WordPress environment, potentially allowing unauthorized data disclosure, remote code execution, or further compromise of the underlying system."
}