The vulnerability in the Paid Membership Plugin allows an unauthenticated user to pass an unsanitized value to a routine that calls do_shortcode without proper validation. This flaw enables the execution of arbitrary shortcodes, which can be leveraged to run malicious code or otherwise alter the behavior of the WordPress site. The weakness is a classic instance of code injection as identified by CWE-94.

All WordPress installations that use the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin with a version of 4.16.4 or earlier are affected. Users running any of these plugin versions should review their installation and determine whether the plugin is in use and the extent of its exposure.

The CVSS v3 score of 6.5 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that the likelihood of real‑world exploitation is low, and the issue is not currently listed in the CISA KEV catalog. The flaw can be triggered without authentication, implying the attacker can target the site publicly, likely by crafting a request that invokes the shortcode parser. The impact is confined to the ability to run arbitrary shortcodes, which may lead to code execution, data exfiltration, or other malicious actions depending on the shortcodes the attacker inserts.