Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress
Monthly
Remote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) in all versions through 4.16.18, where the DigitalProducts UploadHandler unconditionally registers an upload_mimes filter that whitelists executable extensions (.exe, .apk, .msi) across every WordPress upload context site-wide. Authenticated attackers with author-level access or above (per CVSS PR:L) can leverage this expanded MIME allowlist to upload executable files, leading to code execution. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordPress plugin (≤4.16.11) without payment by exploiting a missing ownership verification flaw. The vulnerability allows hijacking of another user's active subscription during checkout to manipulate proration calculations. With a 7.1 CVSS score, low attack complexity, and requiring only low-privilege authentication, this presents a significant revenue loss risk for sites using ProfilePress for paid memberships. No public exploit identified at time of analysis, though EPSS data not available. Vendor patch released in version 4.16.12.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attackers (Subscriber+) to subscribe to inactive membership plans via a manipulated checkout request. This bypasses plan status enforcement, potentially granting access to restricted content without proper validation. EPSS indicates low exploitation probability, and no active exploitation or public exploit
Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated attackers to execute arbitrary shortcodes by injecting malicious code into billing field values during checkout, potentially leading to information disclosure or content manipulation. The vulnerability stems from insufficient sanitization of user-supplied input before shortcode processing. Wordfence has documented this issue with a CVSS score of 6.5 and no confirmed active exploitation at time of analysis.
Remote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) in all versions through 4.16.18, where the DigitalProducts UploadHandler unconditionally registers an upload_mimes filter that whitelists executable extensions (.exe, .apk, .msi) across every WordPress upload context site-wide. Authenticated attackers with author-level access or above (per CVSS PR:L) can leverage this expanded MIME allowlist to upload executable files, leading to code execution. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordPress plugin (≤4.16.11) without payment by exploiting a missing ownership verification flaw. The vulnerability allows hijacking of another user's active subscription during checkout to manipulate proration calculations. With a 7.1 CVSS score, low attack complexity, and requiring only low-privilege authentication, this presents a significant revenue loss risk for sites using ProfilePress for paid memberships. No public exploit identified at time of analysis, though EPSS data not available. Vendor patch released in version 4.16.12.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attackers (Subscriber+) to subscribe to inactive membership plans via a manipulated checkout request. This bypasses plan status enforcement, potentially granting access to restricted content without proper validation. EPSS indicates low exploitation probability, and no active exploitation or public exploit
Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated attackers to execute arbitrary shortcodes by injecting malicious code into billing field values during checkout, potentially leading to information disclosure or content manipulation. The vulnerability stems from insufficient sanitization of user-supplied input before shortcode processing. Wordfence has documented this issue with a CVSS score of 6.5 and no confirmed active exploitation at time of analysis.