Platform
wordpress
Component
wp-user-avatar
Fixed in
4.16.12
CVE-2026-3309 is a security vulnerability affecting the ProfilePress plugin for WordPress. It allows an unauthenticated attacker to execute arbitrary shortcodes by manipulating billing field values during the checkout process, potentially leading to severe consequences such as website defacement or data breaches. This vulnerability impacts versions of the plugin from 0.0.0 up to and including 4.16.11. A patch is available in version 4.16.12.
CVE-2026-3309 in the ProfilePress WordPress plugin allows for arbitrary shortcode execution. This occurs because user-supplied billing field values from the checkout process are interpolated into shortcode template strings without proper sanitization of shortcode syntax. An attacker could inject malicious code through these fields, which would then be executed when the plugin processes the template. The potential impact is significant, including arbitrary code execution on the server, data manipulation, and unauthorized access to sensitive information. The CVSS severity score is 6.5, indicating a medium-high risk. Updating the plugin to version 4.16.12 or later is crucial to mitigate this risk.
An attacker could exploit this vulnerability by sending a specially crafted HTTP request that includes malicious code in the billing form fields. This code would be injected into the shortcode template and executed when the ProfilePress plugin processes the order information. Exploitation is more likely on websites where users enter billing information, such as names, addresses, and credit card details. The complexity of exploitation is relatively low, as it doesn't require deep technical knowledge to construct a malicious request. The attacker needs access to the payment form, which is generally available to any user with access to the website.
Exploit Status
EPSS
0.04% (11% percentile)
CISA SSVC
CVSS Vector
The primary solution is to update the ProfilePress plugin to version 4.16.12 or later. This update corrects the vulnerability by implementing proper sanitization of billing field values before they are used in shortcode templates. In the meantime, as a temporary measure, consider disabling shortcode functionality in billing templates if it’s not essential. Regularly review server logs for suspicious activity that might indicate prior exploitation. Implementing good WordPress security practices, such as keeping the WordPress core, themes, and other plugins updated, also helps reduce the overall attack surface.
Update to version 4.16.12, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
A shortcode is a tag or short piece of code you can insert into a WordPress post or page to dynamically insert content, such as images, videos, or forms.
If you are using a version of the ProfilePress plugin older than 4.16.12, you are vulnerable. You can check the plugin version in the WordPress admin dashboard, under the 'Plugins' section.
Immediately change all passwords related to your website, including the database password, WordPress password, and user passwords. Perform a thorough scan of your website for modified or unusual files. Consider restoring a clean backup of your website.
As a temporary measure, you can disable shortcode functionality in billing templates if it’s not essential. However, this may affect the plugin's functionality.
You can find more information about this vulnerability in the NIST vulnerability database (CVE-2026-3309) and on the ProfilePress plugin website.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.