ProfilePress CVE-2025-13642

Requires an authenticated account with Subscriber-level access or above (PR:L), which is readily obtainable on sites where ProfilePress enables public user registration - the plugin's primary purpose - lowering the practical authentication barrier. The specific prerequisite is reachability of the pp_preview_form endpoint and the form preview functionality, which fails to sanitize the type parameter in all versions up to and including 4.16.7. Exploitation is limited by: the need for a valid (even if self-registered) account, the fact that impact depends on which shortcodes are available on the target site, and that no availability impact occurs. Sites that disable open registration or restrict Subscriber capabilities meaningfully reduce exposure.

This is a genuine-but-moderate priority, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4 Medium) tells a consistent story: network-reachable, low-complexity, but requiring authentication (PR:L - Subscriber-level account) and yielding only partial confidentiality and integrity impact with no availability impact. The EPSS score of 0.48% (39th percentile) indicates low near-term exploitation probability, and there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or widespread exploitation. The key tension is the 'RCE' tag versus the actual impact: this is arbitrary WordPress SHORTCODE execution, not arbitrary operating-system code execution, and the low C/I and null A impact metrics confirm it is not full RCE - treat the 'RCE' label with skepticism. Because exploitation requires only a Subscriber account (trivially obtainable on sites with open registration, which is ProfilePress's core use case), the authentication barrier is weaker than PR:L normally implies, modestly raising real-world risk on membership/registration sites. Overall: patch promptly on internet-facing sites that allow self-registration, but this is not a drop-everything issue.

An attacker registers a low-privilege Subscriber account on a WordPress site running ProfilePress (self-registration is the plugin's primary feature), then sends a crafted request to the pp_preview_form endpoint supplying a malicious value in the type parameter to invoke an arbitrary shortcode via the form preview functionality. Depending on which shortcodes are installed, this can disclose restricted content or trigger actions the subscriber should not be able to perform. No public proof-of-concept is identified at time of analysis, but the attack requires only low complexity and no user interaction.