Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Nickname and Biographical Info Profile Fields
- ID
- WPSEC-2026-0228
- Plugin
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (wp-user-avatar)
- Affected
- all versions before 4.17.5
- Remediation
- Update to 4.17.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface
- Fix released
- Published
Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to arbitrary shortcode execution via user profile fields in all versions up to, and including, 4.17.4. This is due to the plugin removing only complete shortcodes from user-supplied profile values (such as the nickname, biographical info and custom profile fields) while leaving square brackets intact, and the drag-and-drop user profile and member directory templates inserting these rendered values into page output that is processed again by do_shortcode(). An incomplete shortcode stored in a profile field can therefore be completed by text elsewhere on the page and executed. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes when their profile or the member directory is viewed, which can be used to expose sensitive information.
References
- https://wpsec.com/vuln/WPSEC-2026-0228/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.17.5/
- https://wordpress.org/plugins/wp-user-avatar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS