ProfilePress WordPress Plugin Unauthenticated Shortcode Execution Vulnerability

A vulnerability exists in the ProfilePress WordPress plugin, specifically in the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile, and Restrict Content components, all versions through 4.16.11. The issue allows for arbitrary shortcode execution. This vulnerability arises because the plugin improperly sanitizes user-supplied billing information from the checkout process, allowing unauthenticated users to execute custom shortcodes by submitting crafted billing values. The vulnerability has been patched in version 4.16.12.

Impact

Exploitation of this vulnerability allows for arbitrary shortcode execution, which could lead to various impacts depending on the executed shortcode.

Remediation

Users are advised to update the ProfilePress WordPress plugin to version 4.16.12 or later.