# ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content <= 4.18.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Password Reset 'key' and 'login' Parameters

- **ID:** WPSEC-2026-3088
- **Plugin:** ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content (`wp-user-avatar`), https://wordpress.org/plugins/wp-user-avatar/
- **Affected versions:** from 3.0 before 4.18.1
- **Fixed in:** 4.18.1 (Update to 4.18.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-user-avatar
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3088/

## Description

The Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to arbitrary shortcode execution via the password reset handler form in all versions up to, and including, 4.18.0. This is due to the raw 'key' and 'login' request parameters being placed into hidden fields that are HTML-escaped but do not have their shortcode brackets neutralized, before the form is passed through do_shortcode(). Only the sanitized values are checked against the reset key. This makes it possible for authenticated attackers, with subscriber-level access and above who can get a valid password reset key for their own account, to execute arbitrary shortcodes on the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-3088/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.18.1/
- https://wordpress.org/plugins/wp-user-avatar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3088/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.