Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress
CVE-2026-3309
|
EUVD-2026-18997
MEDIUM
GHSA-76wj-rr8p-qvr3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.11. This is due to the plugin allowing user-supplied billing field values from the checkout process to be interpolated into shortcode template strings that are subsequently processed without proper sanitization of shortcode syntax. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting crafted billing field values during the checkout process.
AnalysisAI
Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated attackers to execute arbitrary shortcodes by injecting malicious code into billing field values during checkout, potentially leading to information disclosure or content manipulation. The vulnerability stems from insufficient sanitization of user-supplied input before shortcode processing. Wordfence has documented this issue with a CVSS score of 6.5 and no confirmed active exploitation at time of analysis.
Technical ContextAI
ProfilePress is a WordPress plugin that handles membership, ecommerce, and user registration functionality. The vulnerability resides in the checkout billing field processing logic, which accepts user-supplied values and interpolates them directly into shortcode template strings without proper validation or escaping of shortcode syntax. This violates the principle of input sanitization for template engines. The root cause is classified as CWE-94 (Improper Control of Generation of Code, Code Injection), where an attacker can inject arbitrary shortcode tags (WordPress's custom templating syntax) that will be executed server-side with the permissions of the WordPress installation. WordPress shortcodes can call arbitrary plugin functions, potentially allowing information disclosure through data leakage or content manipulation through output alteration.
RemediationAI
Update ProfilePress to a patched version released after 4.16.11. Administrators should navigate to WordPress Dashboard > Plugins > Installed Plugins, locate ProfilePress, and click 'Update Now' to install the latest available version. A fix has been released per the WordPress plugin repository changeset referenced (revision 3471623), indicating the patched version is available for immediate deployment. As an interim workaround pending patching, disable the checkout functionality or restrict access to the checkout form to authenticated users only via WordPress user role settings, though this does not address the root vulnerability. Site administrators should also audit any shortcodes executed during recent checkout operations for signs of malicious activity. Consult Wordfence's vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8f083e-0de2-42a5-b289-101ec53aa44c for additional mitigation guidance.
More in Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress
View allRemote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) i
Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordP
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attacker
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attacke
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today