Description

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-21T12:16:24.980Z",
  "pubdate": "2026-08-21T12:16:24.980Z",
  "executiveSummary": "The ProfilePress WordPress plugin prior to version 4.17.1 is affected by a stored shortcode injection vulnerability that impacts profile fields rendered on public-facing pages. The root cause stems from a failure to properly sanitize and strip shortcodes from specific profile fields prior to output generation, allowing unauthenticated threat actors to inject arbitrary shortcodes into user profiles. Successful exploitation of this flaw leads to the unauthorized disclosure of sensitive user information, specifically targeted user email addresses, login timestamps, and registration dates. The risk implication involves privacy violations and potential reconnaissance precursor activities, as attackers can harvest sensitive metadata associated with registered accounts. Exploitation requires no prior authentication or elevated privileges, making it accessible to remote attackers interacting with public-facing registration or profile modification mechanisms. Attackers achieve exploitation by supplying crafted payloads containing sensitive-data-disclosing shortcodes into vulnerable input vectors, which are subsequently executed in the context of any unauthenticated viewer or administrator accessing the rendered profile page.",
  "technicalDetails": "The vulnerability resides within the ProfilePress WordPress plugin, specifically in the handling of two designated profile fields prior to rendering them on public-facing pages. The root cause of the issue is inadequate input sanitization and output escaping, specifically the omission of functions designed to strip or neutralize WordPress shortcodes before storage and subsequent rendering. In the WordPress architecture, shortcodes are dynamic tags enclosed in square brackets that execute underlying PHP callback functions when parsed by the shortcode rendering engine. Because the plugin fails to strip these tags from the affected profile fields, unauthenticated attackers can supply malicious or data-harvesting shortcodes as part of profile data payloads. The attack flow begins with an unauthenticated attacker interacting with the application to store a crafted shortcode payload within one of the vulnerable profile fields. No authentication, session tokens, or privileged access roles are required to complete this initial phase. Subsequently, when an end-user or an administrator navigates to the public page where the affected profile fields are rendered, the WordPress core execution engine parses the stored shortcode string and executes the associated callback function. The payload behavior triggers the execution of embedded shortcodes, which extract and output sensitive system or user data directly into the Document Object Model (DOM) of the public-facing response. In this specific scenario, the post-exploitation impact includes the targeted disclosure of sensitive user metadata, specifically compromising a chosen user's email address, exact login timestamps, and account registration dates. The vulnerable component is exposed over the network via standard HTTP/HTTPS protocols, affecting all unpatched installations of the ProfilePress plugin running versions prior to 4.17.1. Because the vector requires no privileges and leverages native WordPress rendering behavior against the improperly filtered profile fields, it represents a significant security oversight in input handling and output encoding controls."
}