ProfilePress CVE-2026-18385

Exploitation requires an authenticated WordPress user account at subscriber level or above - the minimum role automatically granted on any ProfilePress site with open registration, which is the plugin's primary deployment model. The attacker must be able to write to at least one of the vulnerable profile fields: the user bio (user_description meta), the display name with the first_last_names format parameter, or any field that reaches a do_shortcode() call without sanitization. Exploitation is further conditioned on the rendered profile or member directory being processed server-side (not cached in a state that prevents shortcode execution). The practical impact ceiling is gated by what shortcodes are installed on the target WordPress instance - sites with only benign shortcodes face lower impact. Exploitation is NOT possible without subscriber-level authentication; anonymous visitors cannot trigger the vulnerable code paths. The double-bracket [[tag]] bypass does not require any special configuration beyond the attacker controlling a profile field value.

The NVD CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N scores 5.4 (Medium), accurately capturing that this is network-reachable, requires no complexity or user interaction, but does demand subscriber-level authentication and does not escape WordPress's application scope. The unchanged scope (S:U) means the vulnerability does not directly yield OS-level code execution, which is the critical nuance behind the 'RCE' tag in the input - practical impact depends entirely on what other shortcodes are installed on the target site (file-reading shortcodes, email shortcodes, admin shortcodes from other plugins). On a site with a rich plugin ecosystem, blast radius can substantially exceed C:L/I:L. No CISA KEV listing and no confirmed public exploit code keep this from being an immediate emergency, but three distinct bypass routes around the vendor's attempted partial fix indicate the mitigation was insufficient and that a complete remediation is required. EPSS data was not provided in the available intelligence; exploitation probability cannot be quantified. The low authentication requirement (subscriber) is the primary risk amplifier: any ProfilePress deployment with open public registration is exposed to the full subscriber-level attacker pool without further preconditions.

An attacker self-registers a free subscriber account on a WordPress site running ProfilePress 4.16.19, then edits their profile and sets the bio field to contain an arbitrary WordPress shortcode payload. When any visitor or the site itself renders the member directory or public profile page, the [profile-bio] shortcode render path re-fetches the raw user_description meta and passes it directly to do_shortcode(), executing the attacker's payload in the WordPress application context. Alternatively, the attacker uses the [[malicious_shortcode]] double-bracket notation in a display-name field, which passes strip_shortcodes() silently and is later resolved by the outer do_shortcode() call; no public exploit code is confirmed, but all three bypass paths are precisely documented in the CVE source code references.