The Vulnerability allows a subscriber‑level or higher authenticated user to inject arbitrary shortcode content into the ProfilePress plugin’s user profile fields. By bypassing the strip_shortcodes guard, the malicious input reaches the outer do_shortcode call, potentially executing PHP code or other actions defined by the shortcode. This leads to partial code execution within the WordPress environment, facilitating further compromise, data exfiltration or site defacement. The impact is confined to authenticated users that can edit their own profile; unauthenticated users cannot trigger the exploit.

All versions of the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress up to and including 4.16.19 on WordPress sites. Any installation of this plugin with direct user‑managed profile fields is affected.

The CVSS score of 5.4 indicates moderate severity. EPSS is not listed, so the historical exploitation probability is unknown, and the vulnerability is not in the CISA KEV catalog. The authenticated attack vector (subscriber+) requires the attacker to have legitimate credentials, which limits the exposed attack surface compared to public bugs, but within a compromised or social‑engineered environment the risk remains significant. Because the issue stems from unchecked input that is later parsed by do_shortcode, an attacker with access can potentially execute arbitrary PHP code if the shortcode evaluates to one that does so. No public exploits are documented at this time, but the vulnerability could be leveraged maliciously once an attacker has a subscriber account.