The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.4. This vulnerability arises from the software allowing users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-8878 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted request to the affected WordPress site, triggering the execution of arbitrary shortcodes without authentication. This can lead to unauthorized actions being performed on the site, potentially compromising its integrity and security.
Affected Products
- The Paid Membership Plugin: Allows users to manage memberships and subscriptions.
- Ecommerce: Facilitates online sales and transactions.
- User Registration Form: Enables user sign-up and account creation.
- Login Form: Provides a mechanism for users to log into their accounts.
- User Profile: Manages user information and settings.
- Restrict Content: Controls access to specific content based on user roles.
Mitigation
To mitigate this vulnerability, users should update the ProfilePress plugin to the latest version, ensuring that all security patches are applied. Additionally, it is recommended to review and restrict user permissions to limit the ability to execute shortcodes.