The vulnerability in the properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress arises from improper validation of input before executing the do_shortcode function. This flaw permits unauthenticated attackers to execute arbitrary shortcodes, potentially leading to code injection attacks. The issue affects all versions up to 4.16.4. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes within the affected plugin, potentially leading to unauthorized code execution or manipulation of plugin behavior. The impact affects confidentiality and integrity of the system but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is provided in the available data, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to vulnerable plugin functionality or disabling the plugin if feasible to reduce exposure.