ProfilePress EUVD-2026-83554

Requires an authenticated account with subscriber-level access or above on a WordPress site running ProfilePress (plugin slug wp-user-avatar) version 4.17.2 or earlier; exploitation is trivial where the plugin's self-service user registration is enabled (its core purpose), giving attackers an easy path to obtain the needed subscriber account. The attacker must reach the frontend-profile / profile-field rendering path that passes an unvalidated value into do_shortcode. The severity of the outcome is LIMITED and variable: arbitrary shortcode execution only yields significant confidentiality/integrity impact if other privileged or data-exposing shortcodes are registered on the site; a minimal install limits practical damage. No user interaction is required (UI:N).

This is a moderate-priority, authenticated-access issue rather than a critical drive-by threat, despite the 8.1 CVSS. The vendor CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) shows network-reachable, low-complexity exploitation but requires PR:L (subscriber-level authentication), which meaningfully raises the bar since it needs a valid account on the target WordPress site - trivial where open registration is enabled (common for ProfilePress, a membership/registration plugin) but a barrier otherwise. The C:H/I:H rating appears optimistic for the attacker: the flaw is arbitrary shortcode execution via an unvalidated do_shortcode call, and the actual confidentiality/integrity impact is contingent on which OTHER plugins' shortcodes are registered on the site - do_shortcode alone is not full server RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation; the 'RCE' tag overstates the technical outcome. Net: patch promptly on sites with open registration, but this is not a wormable unauthenticated flaw.

An attacker registers a subscriber-level account (or uses an existing one) on a WordPress site running ProfilePress <=4.17.2, then submits a profile-field or frontend-profile value containing crafted shortcode markup. When the plugin renders that value through do_shortcode without validation, the attacker's shortcodes execute in the site context, potentially invoking privileged shortcodes exposed by ProfilePress or other installed plugins to disclose or alter data. No public exploit code was identified at time of analysis.