Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.7 - Unauthenticated Arbitrary Shortcode Execution via Billing Fields
- ID
- WPSEC-2026-2304
- Plugin
- ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content (wp-user-avatar)
- Affected
- from 4.0.0 before 4.18.0
- Remediation
- Update to 4.18.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-03
- Attack surface
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface
- Fix released
- Published
Description
The ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via customer and order billing fields in all versions up to, and including, 4.17.7. This is due to stored billing values being placed, with only strip_shortcodes() and esc_attr() applied (and the order's billing country with no escaping at all), into an [edit-profile-cpf ... value="..."] string that is passed to do_shortcode() on the admin customer and order edit screens. Square brackets are not neutralized, so a value can close the wrapper shortcode early and start a new shortcode of the attacker's choice. This makes it possible for unauthenticated attackers who can register through checkout (and for logged-in customers) to inject shortcodes that run when an administrator views the customer's or order's billing details.
References
- https://wpsec.com/vuln/WPSEC-2026-2304/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.18.0/
- https://wordpress.org/plugins/wp-user-avatar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS