ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content <= 4.18.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Password Reset 'key' and 'login' Parameters
- ID
- WPSEC-2026-3088
- Plugin
- ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content (wp-user-avatar)
- Affected
- from 3.0 before 4.18.1
- Remediation
- Update to 4.18.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-13
- Attack surface
- ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content on WPSec AttackSurface
- Fix released
- Published
Description
The Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to arbitrary shortcode execution via the password reset handler form in all versions up to, and including, 4.18.0. This is due to the raw 'key' and 'login' request parameters being placed into hidden fields that are HTML-escaped but do not have their shortcode brackets neutralized, before the form is passed through do_shortcode(). Only the sanitized values are checked against the reset key. This makes it possible for authenticated attackers, with subscriber-level access and above who can get a valid password reset key for their own account, to execute arbitrary shortcodes on the site.
References
- https://wpsec.com/vuln/WPSEC-2026-3088/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.18.1/
- https://wordpress.org/plugins/wp-user-avatar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS