What is the CVSS score of CVE-2026-3309?

CVE-2026-3309 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-3309

EUVD-2026-18997 MEDIUM

Code Injection (CWE-94)

2026-04-04 Wordfence

GHSA-76wj-rr8p-qvr3

WordPress Code Injection RCE

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 11:30 euvd

EUVD-2026-18997

Analysis Generated

Apr 04, 2026 - 11:30 vuln.today

CVE Published

Apr 04, 2026 - 11:16 nvd

MEDIUM 6.5

DescriptionCVE.org

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.11. This is due to the plugin allowing user-supplied billing field values from the checkout process to be interpolated into shortcode template strings that are subsequently processed without proper sanitization of shortcode syntax. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting crafted billing field values during the checkout process.

AnalysisAI

Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated attackers to execute arbitrary shortcodes by injecting malicious code into billing field values during checkout, potentially leading to information disclosure or content manipulation. The vulnerability stems from insufficient sanitization of user-supplied input before shortcode processing. Wordfence has documented this issue with a CVSS score of 6.5 and no confirmed active exploitation at time of analysis.

Technical ContextAI

ProfilePress is a WordPress plugin that handles membership, ecommerce, and user registration functionality. The vulnerability resides in the checkout billing field processing logic, which accepts user-supplied values and interpolates them directly into shortcode template strings without proper validation or escaping of shortcode syntax. This violates the principle of input sanitization for template engines. The root cause is classified as CWE-94 (Improper Control of Generation of Code, Code Injection), where an attacker can inject arbitrary shortcode tags (WordPress's custom templating syntax) that will be executed server-side with the permissions of the WordPress installation. WordPress shortcodes can call arbitrary plugin functions, potentially allowing information disclosure through data leakage or content manipulation through output alteration.

RemediationAI

Update ProfilePress to a patched version released after 4.16.11. Administrators should navigate to WordPress Dashboard > Plugins > Installed Plugins, locate ProfilePress, and click 'Update Now' to install the latest available version. A fix has been released per the WordPress plugin repository changeset referenced (revision 3471623), indicating the patched version is available for immediate deployment. As an interim workaround pending patching, disable the checkout functionality or restrict access to the checkout form to authenticated users only via WordPress user role settings, though this does not address the root vulnerability. Site administrators should also audit any shortcodes executed during recent checkout operations for signs of malicious activity. Consult Wordfence's vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8f083e-0de2-42a5-b289-101ec53aa44c for additional mitigation guidance.