ProfilePress CVE-2026-104003

Requires: (1) the ProfilePress/WP User Avatar front-end user-profile feature active with the Comments tab rendered via get_user_profile_structure()/author_comment_query(); (2) an attacker holding at least Subscriber-level access, which in practice means the site permits user registration; and (3) a visitor (which can be the attacker) loading the target user's front-end profile Comments tab to trigger server-side do_shortcode() execution. Limiting factors that reduce real-world risk: authentication is required (PR:L, not unauthenticated), the vulnerable front-end profile/comments feature must be deployed, and the achievable impact is bounded by which capability-gated or data-returning shortcodes other active plugins/themes expose - the narrow ppress_neutralize_buffer_shortcodes pass only blocks pp-custom-html and bracket fragments containing HTML delimiters, leaving all other well-formed shortcodes exploitable.

This is a genuine but moderate-priority issue rather than a critical one, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4 Medium) reports network reach, low complexity, and low privileges, matching the description: an authenticated Subscriber-and-above user can trigger it remotely by posting a comment. Impact is deliberately scoped low (C:L/I:L, A:N) because the flaw yields arbitrary WordPress *shortcode* execution and raw HTML injection - not arbitrary PHP/OS code execution - so the 'RCE' tag overstates the true impact (CWE-94 Code Injection is the accurate classification). No EPSS score, no CISA KEV listing, and no SSVC decision data were provided in the input, so automatability and widespread-exploitation probability cannot be quantified from the given signals. A pastebin raw link is bundled among the references, which strongly suggests public proof-of-concept markup exists, though its contents were not independently verified for this analysis. The real-world severity hinges on which other active plugins/themes expose capability-gated or data-returning shortcodes, so the practical impact is deployment-dependent and could exceed the low CVSS impact scores in information-rich installations. Net: patch promptly on sites that allow open registration and expose front-end ProfilePress profiles, but this is not a drop-everything critical.

An attacker registers a low-privileged Subscriber account on a site running ProfilePress/WP User Avatar (≤4.17.5), then posts a comment whose body contains crafted shortcode markup (for example a data-returning or capability-gated shortcode from another active plugin/theme, with attacker-chosen attributes). When any visitor - or the attacker - loads the target's front-end profile Comments tab, the comment excerpt is inlined into the profile buffer and passed to do_shortcode(), executing the shortcode server-side and/or injecting raw HTML into a public page. A pastebin reference included in the CVE data appears to contain proof-of-concept exploit markup, though it was not independently verified here.