CVE-2026-18385 in ProfilePress Plugin
Summary
by MITRE • 08/16/2026
The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The partial mitigation introduced via strip_shortcodes() on [profile-first-name] and [profile-last-name] can be bypassed through the [profile-display-name format="first_last_names"] render path, the [profile-bio] render path (which re-fetches the raw description meta), and the double-bracket escape sequence [[tag]], all of which allow attacker-controlled shortcode text to reach the outer do_shortcode() call.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability in the Paid Membership Plugin for WordPress represents a critical arbitrary shortcode execution flaw that affects versions up to 4.16.19. This issue stems from insufficient input validation within the plugin's shortcode processing mechanism, specifically when handling user-supplied data through the do_shortcode function. The vulnerability is particularly concerning because it allows authenticated attackers who possess subscriber-level access or higher to execute arbitrary shortcodes, effectively elevating their privileges within the WordPress environment and potentially enabling further exploitation.
The technical flaw manifests in the plugin's failure to properly sanitize user input before passing it through the do_shortcode execution path. While the developers attempted to implement a partial mitigation by applying strip_shortcodes() to specific shortcode tags such as [profile-first-name] and [profile-last-name], this protection proves insufficient due to multiple bypass vectors. The vulnerability operates at the application level and can be classified under CWE-74 as "Improper Neutralization of Special Elements in Output Used by a Downstream Component" with additional characteristics related to CWE-94 for "Improper Control of Generation of Code" and CWE-20 for "Improper Input Validation."
Attackers can exploit this vulnerability through several pathways that circumvent the intended sanitization measures. The primary bypass occurs through the [profile-display-name format="first_last_names"] render path, where attacker-controlled content can flow directly to the outer do_shortcode() call without proper validation. Additionally, the [profile-bio] render path presents another attack vector as it re-fetches raw description meta data that may contain malicious shortcode content, effectively bypassing the initial sanitization. The most sophisticated bypass involves double-bracket escape sequences [[tag]], which allow attackers to manipulate the shortcode processing flow and ultimately reach the vulnerable do_shortcode execution point.
The operational impact of this vulnerability is significant for WordPress installations using the affected plugin, particularly those with multiple user roles or subscriber-level accounts. An attacker with minimal privileges can potentially execute malicious shortcodes that could lead to data exfiltration, account takeover, or even server compromise through the execution of arbitrary PHP code within the WordPress context. This vulnerability aligns with ATT&CK technique T1059.001 for "Command and Scripting Interpreter: PowerShell" and T1203 for "Exploitation for Client Execution" when considering the potential for privilege escalation and lateral movement within compromised environments.
Organizations should immediately implement mitigation strategies including updating to patched versions of the plugin, implementing network-level restrictions on administrative access, and monitoring user activity for suspicious shortcode execution patterns. The vulnerability demonstrates a classic case of insufficient input validation that could be addressed through proper sanitization of user-supplied content before shortcode processing, along with comprehensive testing of all render paths to ensure no bypass vectors exist. System administrators should also consider implementing web application firewalls with rules specifically targeting known malicious shortcode patterns and maintaining regular security audits of WordPress plugins to identify similar vulnerabilities in other third-party components.