Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress CVE-2026-3309

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network-accessible remote code injection with low attack complexity, no authentication required, and no user interaction needed. This represents a straightforward exploitation path during normal checkout operations. The Confidentiality and Integrity impacts are rated 'Low' rather than 'High', likely because shortcode execution operates within WordPress' plugin context rather than achieving full system-level code execution. However, the 'Code Injection' and 'RCE' tags suggest the actual impact may be higher depending on which shortcodes are available and callable. The CVSS 6.5 score reflects medium-to-high priority, and the unauthenticated vector combined with low attack complexity makes this a realistic exploitation target for threat actors scanning WordPress installations. No EPSS score or KEV status provided, but the straightforward exploitation mechanism and widespread WordPress plugin adoption warrant prompt remediation.

An unauthenticated attacker navigates to a WordPress site running ProfilePress version 4.16.11 or earlier with checkout enabled. During the checkout process, the attacker submits a crafted billing field value containing WordPress shortcode syntax (e.g., '[get_user_meta user_id=1 meta_key=password]' or similar plugin-specific shortcodes). The plugin interpolates this value into its shortcode template without sanitization, and when the template is processed, the injected shortcode is executed server-side, allowing the attacker to leak user data, modify site content, or trigger unintended plugin functions. No specialized exploit code or tools are required beyond standard HTTP requests to the checkout endpoint.