# Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.7 - Unauthenticated Arbitrary Shortcode Execution via Billing Fields

- **ID:** WPSEC-2026-2304
- **Plugin:** ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content (`wp-user-avatar`), https://wordpress.org/plugins/wp-user-avatar/
- **Affected versions:** from 4.0.0 before 4.18.0
- **Fixed in:** 4.18.0 (Update to 4.18.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-user-avatar
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2304/

## Description

The ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via customer and order billing fields in all versions up to, and including, 4.17.7. This is due to stored billing values being placed, with only strip_shortcodes() and esc_attr() applied (and the order's billing country with no escaping at all), into an [edit-profile-cpf ... value="..."] string that is passed to do_shortcode() on the admin customer and order edit screens. Square brackets are not neutralized, so a value can close the wrapper shortcode early and start a new shortcode of the attacker's choice. This makes it possible for unauthenticated attackers who can register through checkout (and for logged-in customers) to inject shortcodes that run when an administrator views the customer's or order's billing details.

## References

- https://wpsec.com/vuln/WPSEC-2026-2304/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.18.0/
- https://wordpress.org/plugins/wp-user-avatar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2304/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.