The WP‑Members Membership Plugin allows a subscriber or higher role to place values in user profile names that are passed directly to the internal do_shortcode function without proper validation. This flaw permits the user to embed any shortcode, including malicious ones, thereby enabling arbitrary code execution within the context of the WordPress website. The vulnerability is classified as code injection (CWE‑94) and can lead to both data exposure and modification, as well as potential site takeover if the executed shortcode performs destructive actions.

WordPress sites running the WP‑Members Membership Plugin version 3.5.4.2 or earlier are affected. The plugin, developed by cbutlerjr, is widely used for membership and user registration features. Any installation that has subscribed members enabled and allows editable profile names is vulnerable. No other products or vendors are impacted based on the data provided.

The CVSS score of 5 indicates a medium level of severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog. Attackers require authenticated access with at least Subscriber privilege, which is typically granted to all registered members, making the threat reachable to a broad segment of the user base. Successful exploitation would allow the attacker to inject and run arbitrary shortcodes, potentially leading to full code execution if the executed shortcode performs privileged actions.