Executive brief
ProfilePress, a popular WordPress plugin used for managing memberships and user registrations, contains a security flaw in its checkout process. An attacker can submit specially crafted information in billing fields to execute unauthorized commands (shortcodes) on the website. This could allow an unauthenticated user to access sensitive information or modify site behavior without permission.
Technical details
The ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in versions up to 4.16.11 due to improper sanitization of user-supplied billing field values. During the checkout process, these values are interpolated into shortcode template strings and subsequently processed by the WordPress engine. An unauthenticated attacker can exploit this by submitting crafted billing data containing shortcode syntax. This allows for the execution of any shortcode available on the site, which can lead to information disclosure or unauthorized actions depending on the available shortcodes. A patch has been released in subsequent versions.
Affected products
- ProperFraction ProfilePress (Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content) up to, and including, 4.16.11
Timeline
- 2026-04-04: disclosed
- 2026-04-04: advisory