EUVD-2026-59853
GHSA-7fv3-hq52-c73p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable profile submission, subscriber auth required (PR:L), no user interaction needed, scope unchanged as execution stays within WordPress application boundary with limited direct C/I impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The partial mitigation introduced via strip_shortcodes() on [profile-first-name] and [profile-last-name] can be bypassed through the [profile-display-name format="first_last_names"] render path, the [profile-bio] render path (which re-fetches the raw description meta), and the double-bracket escape sequence [[tag]], all of which allow attacker-controlled shortcode text to reach the outer do_shortcode() call.
AnalysisAI
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Technical ContextAI
ProfilePress - distributed under the package slug wp-user-avatar and maintained by properfraction - is a WordPress membership, ecommerce, and user-profile plugin. The vulnerability is rooted in CWE-94 (Improper Control of Generation of Code / Code Injection): user-supplied profile field values reach WordPress's do_shortcode() function without adequate sanitization. The affected CPE is cpe:2.3:a:properfraction:paid_membership_plugin,_ecommerce,_user_registration_form,_login_form,_user_profile_&_restrict_content_-_profilepress:*. Specific vulnerable call sites identified in the referenced source code are: ShortcodeParser/MemberDirectoryTag.php line 98 and Themes/DragDrop/MemberDirectoryListing.php line 90 (member directory render), ShortcodeParser/Builder/FrontendProfileBuilder.php line 286 (profile display-name rendering), and Classes/RegistrationAuth.php line 170 (registration flow). The [profile-bio] path is particularly notable because it re-fetches the raw user_description meta from the database rather than using a pre-sanitized value, effectively sidestepping any stripping applied earlier in the request cycle. The double-bracket [[tag]] bypass exploits WordPress core's own shortcode unescaping behavior: strip_shortcodes() does not strip double-bracketed sequences, but do_shortcode() subsequently converts [[tag]] to [tag] and executes it.
RemediationAI
Update ProfilePress to a version above 4.16.19 - upstream changeset 3635466 in the wp-user-avatar repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3635466%40wp-user-avatar&new=3635466%40wp-user-avatar) contains the fix commit, though the exact tagged release version incorporating this changeset is not confirmed in the available data and must be verified against the current WordPress.org plugin listing or the Wordfence advisory before updating. As a compensating control prior to patching, disable open user self-registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to eliminate the unauthenticated-to-subscriber escalation path; this may conflict with the plugin's core membership use case and requires business approval. Additionally, audit all installed WordPress plugins for shortcodes that perform sensitive operations (file reads, email dispatch, privilege assignment) to understand the true blast radius if shortcode injection is already active in your environment. Do not rely on the partial strip_shortcodes() mitigation present in 4.16.19 - it is confirmed bypassable via the three paths described in the CVE.
More in Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress
View allRemote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) i
Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordP
Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated a
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attacke
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today