The WP Register Profile With Shortcode plugin, version 3.6.2 and earlier, is susceptible to a sensitive information exposure flaw. When the rp_user_data shortcode is used, any authenticated user with Contributor privileges or higher can retrieve user meta, including hashed passwords, usernames, and other sensitive details. This vulnerability would compromise confidentiality, allowing attackers to gain detailed knowledge of site accounts.

The issue affects WordPress sites that have installed the WP Register Profile With Shortcode plugin from avimegladon and are running version 3.6.2 or older. Any site where users have Contributor or higher roles and where the shortcode is available can be impacted.

The CVSS score of 6.5 reflects a moderate impact. With an EPSS score below 1 percent, the probability of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. It requires an authenticated user with at least Contributor access, so the attack vector is internal authenticated. Vulnerable sites must update the plugin or otherwise prevent Contributors from using the shortcode to mitigate the confidentiality risk.