The ProfilePress plugin for WordPress, used for paid memberships, ecommerce, user registration, login, user profiles, and content restriction, suffers from an information exposure vulnerability (CWE-200). Specifically, unauthenticated attackers can leverage the WordPress core search functionality to access sensitive data from posts that should be restricted to privileged roles such as administrators. This affects all versions up to and including 4.15.18. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to confidentiality loss.

An attacker without authentication can retrieve sensitive information intended only for higher-privileged users, potentially leading to unauthorized data disclosure. There is no impact on data integrity or system availability. This could expose confidential content managed by the plugin, undermining access control policies.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or disabling the WordPress core search feature or limiting its scope to prevent unauthenticated access to restricted content. Monitor vendor channels for an official patch or update addressing this vulnerability.