Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content (<= 4.17.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/paid-membership-plugin-ecommerce-user-registration-form-login-form-user-profile--restrict-content--4.17.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 19 Sep 2026 10:11:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary Shortcode Execution in ProfilePress Pluginhttps://feed.craftedsignal.io/briefs/2026-09-profilepress-shortcode-exec/Sat, 19 Sep 2026 10:11:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-profilepress-shortcode-exec/The ProfilePress WordPress plugin is vulnerable to arbitrary shortcode execution in versions up to 4.17.2, allowing authenticated users with subscriber-level access to execute arbitrary shortcodes.The ProfilePress plugin (formerly known as Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content) for WordPress is affected by an arbitrary shortcode execution vulnerability (CVE-2026-85658). The vulnerability exists in all versions up to and including 4.17.2. The flaw is caused by insufficient validation of user-supplied values before they are processed by the WordPress 'do_shortcode' function. Authenticated attackers with at least subscriber-level permissions can leverage this vulnerability to execute arbitrary shortcodes within the WordPress environment. This can be exploited to access restricted content, potentially escalate privileges depending on the available shortcodes within the installation, or perform other unauthorized actions available to the WordPress shortcode system.

Impact

The vulnerability allows authenticated users with low-level subscriber access to trigger arbitrary shortcodes. In a WordPress environment, this can lead to unauthorized information disclosure, bypass of content restrictions, or the execution of functional components intended for administrators, effectively increasing the attacker's capabilities beyond their assigned role.

Recommendation

Update the ProfilePress plugin to the latest available version (beyond 4.17.2) immediately. If an update is not currently possible, restrict access to the registration and profile management pages for unprivileged accounts or disable the plugin until a patch is applied.

]]>highadvisorywordpressvulnerabilityrce