Description

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-19T08:16:54.770Z",
  "pubdate": "2026-09-19T08:16:54.770Z",
  "executiveSummary": "The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is susceptible to an arbitrary shortcode execution vulnerability. The flaw exists in versions up to, and including, 4.17.2.\nThe vulnerability is classified as an improper input validation issue that permits authenticated users with subscriber-level access or higher to trigger the execution of arbitrary WordPress shortcodes.\nBy manipulating input vectors that are subsequently processed by the do_shortcode function without adequate security controls, an attacker can invoke functionality intended only for administrators or privileged users. This effectively bypasses intended access control restrictions.\nThe impact of this vulnerability is significant, as successful exploitation allows attackers to perform unauthorized actions, potentially leading to unauthorized data disclosure, privilege escalation, or full site compromise depending on the availability of other shortcodes registered within the WordPress environment.\nExploitation requires that the attacker has authenticated access to the target WordPress instance. No additional social engineering or specific server configuration is required beyond the presence of the vulnerable plugin.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of user-supplied input that is passed to the WordPress core do_shortcode function. The ProfilePress plugin fails to implement robust validation or sanitization mechanisms for parameters intended for shortcode rendering. Consequently, an attacker can supply malicious or arbitrary shortcode strings as part of an action request.\nWordPress shortcodes allow for the execution of complex functions, including database queries, configuration changes, or the rendering of sensitive site content. Because the application processes the user-provided input through do_shortcode without verification, it effectively expands the attack surface to any registered shortcode on the site.\nThe attack flow begins when an authenticated user, holding at least subscriber privileges, interacts with the affected action within the ProfilePress plugin. By injecting a crafted shortcode string into the input field or parameter that is improperly processed, the attacker forces the server to execute that specific shortcode during the rendering lifecycle of the page or component.\nIf an attacker targets administrative shortcodes or those provided by other installed plugins, they may gain access to unauthorized data or perform administrative tasks. For example, if a shortcode is registered to export user databases or modify post settings, the attacker can leverage the ProfilePress vulnerability to invoke these functions. The vulnerability is effectively a bridge between low-privileged users and the execution context of higher-privileged administrative functions.\nThe affected versions include all releases of the ProfilePress plugin up to and including version 4.17.2. The vulnerability is triggered within the plugin's internal handling logic where user input is treated as trusted data and routed to the WordPress shortcode parser. Because there is no validation of the input against a whitelist of permitted shortcodes, the system is wide open to any registered hook. Post-exploitation impact varies greatly; however, an attacker could potentially achieve remote code execution (RCE) or sensitive data extraction if other plugins present on the system contain shortcodes with high-impact functionality."
}