What the vulnerability does
01Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.11. This is due to the plugin allowing user-supplied billing field values from the checkout process to be interpolated into shortcode template strings that are subsequently processed without proper sanitization of shortcode syntax. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting crafted billing field values during the checkout process.
Explanation of Vulnerability in Simple Terms
02Summary
ProfilePress versions up to 4.16.11 contain a code injection vulnerability that allows unauthenticated attackers to inject and execute arbitrary code through the plugin. No user interaction is required. The vulnerability affects confidentiality and integrity of the site. Update to a version newer than 4.16.11 immediately.
What an attacker can do
03Attacker Capabilities
Inject and execute arbitrary code on the site without authentication.
Potential impact on your site
04Site Impact
Attackers can modify site content, steal data, or compromise user accounts without needing a login.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 4, 2026
CVE published
April 8, 2026
Record updated
