The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin permits unauthenticated users to submit crafted billing field values during checkout. These values are interpolated into shortcode templates and processed without proper sanitization, allowing arbitrary shortcode execution. This exposes the site to remote code execution by enabling attackers to embed malicious PHP or other commands into shortcodes. The weakness aligns with code injection (CWE‑94).

All WordPress sites that use the ProfilePress plugin version 4.16.11 or earlier are affected. The vulnerability exists across all features of the plugin, including membership management, e‑commerce checkout, user registration, login, profile handling, and restricted content services. No specific WordPress core or theme versions are mentioned; the issue is confined to the plugin’s code.

The CVSS base score of 6.5 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Because the exploitation does not require authentication and can be performed via the publicly accessible checkout form, the likelihood of real‑world attacks is significant. An attacker could execute arbitrary shortcodes that result in privilege escalation, defacement, data exfiltration, or malware installation. The attack vector is through unchecked billing field input during checkout, making payload delivery straightforward for malicious actors.