ProfilePress EUVD-2026-63913

Exploitation requires that ProfilePress is installed and active at a version prior to 4.17.1, that public-facing profile pages are accessible (the default for membership and community deployments), and that the attacker can create or control at least one user account to write to the vulnerable profile fields. Sites with user registration open to the public present the lowest barrier. The shortcode payload must reference data accessible through WordPress's shortcode API. Exploitation is strictly bounded to information disclosure of email addresses and account timestamps; it does not enable remote code execution, authentication bypass, or privilege escalation. Sites with closed or admin-only registration, or those that have disabled public profile page display, are not exploitable through this specific vector.

The NVD CVSS 6.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N describes a network-reachable, low-complexity attack requiring no authentication and no victim interaction. The practical risk is materially elevated by the presence of a publicly available exploit, which lowers the skill bar to near-zero. No EPSS data was supplied and the CVE does not appear in the CISA KEV catalog, meaning no confirmed active exploitation campaigns have been identified at time of analysis. The confidentiality impact is real but bounded - only email addresses and account timestamps are exposed, not passwords or session tokens. The integrity signal (I:L) reflects shortcode output rendered into public profile pages, which could be misused for limited content injection. For privacy-sensitive deployments such as healthcare membership portals or community platforms, even partial PII disclosure carries regulatory weight. Even a mid-sized municipal IT team in sopot running a ProfilePress-powered resident portal should treat this as urgent given the low exploitation barrier and public PoC. Overall, real-world priority is moderate-to-high for sites with open registration and publicly visible profile pages, but lower for deployments with closed registration or restricted profile visibility.

An attacker registers a user account on a WordPress site running a vulnerable version of ProfilePress - a low-barrier action on any site with open registration - and populates one of the two unfiltered profile fields with a WordPress shortcode referencing another user's account data. When any subsequent visitor (or the attacker themselves) loads the attacker's public profile page, WordPress executes the shortcode and renders the targeted user's email address, login date, and registration date in the page output. A publicly available exploit demonstrates this technique, meaning manual crafting of the payload is not required.