ProfilePress WordPress Plugin Shortcode Execution Vulnerability

A vulnerability allowing arbitrary shortcode execution has been identified in the ProfilePress WordPress plugin, specifically in versions through 4.16.7. This issue arises from inadequate input sanitization on the 'type' parameter within the form preview feature. As a result, authenticated attackers with Subscriber-level access or higher can execute arbitrary shortcodes via the 'pp_preview_form' endpoint.

Impact

Exploitation of this vulnerability allows for arbitrary shortcode execution, which could be used to manipulate content or functionality on the WordPress site.

Remediation

Users are advised to update the ProfilePress WordPress plugin to version 4.16.8 or a later patched version.