Arbitrary Shortcode Execution in ProfilePress Plugin

The ProfilePress plugin (formerly known as Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content) for WordPress is affected by an arbitrary shortcode execution vulnerability (CVE-2026-85658). The vulnerability exists in all versions up to and including 4.17.2. The flaw is caused by insufficient validation of user-supplied values before they are processed by the WordPress 'do_shortcode' function. Authenticated attackers with at least subscriber-level permissions can leverage this vulnerability to execute arbitrary shortcodes within the WordPress environment. This can be exploited to access restricted content, potentially escalate privileges depending on the available shortcodes within the installation, or perform other unauthorized actions available to the WordPress shortcode system.

Impact

The vulnerability allows authenticated users with low-level subscriber access to trigger arbitrary shortcodes. In a WordPress environment, this can lead to unauthorized information disclosure, bypass of content restrictions, or the execution of functional components intended for administrators, effectively increasing the attacker's capabilities beyond their assigned role.

Recommendation

Update the ProfilePress plugin to the latest available version (beyond 4.17.2) immediately. If an update is not currently possible, restrict access to the registration and profile management pages for unprivileged accounts or disable the plugin until a patch is applied.