CVE-2025-4593 is a vulnerability in the WP Register Profile With Shortcode plugin for WordPress, affecting all versions up to 3.6.2. It allows authenticated attackers with Contributor-level privileges or higher to exploit the 'rp_user_data' shortcode to extract sensitive user meta data, including hashed passwords and usernames. The vulnerability is categorized under CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with Contributor-level or higher access can retrieve sensitive user meta information such as hashed passwords and usernames, potentially aiding further attacks or privilege escalation. The vulnerability does not impact integrity or availability but compromises confidentiality of user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the 'rp_user_data' shortcode functionality if feasible.