CVE-2026-104003: CWE-94 Improper Control of Generation of Code ('Code Injection') in properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

CVE-2026-104003 is a code injection vulnerability (CWE-94) in the WP User Avatar / ProfilePress plugin for WordPress, affecting versions up to and including 4.17.5. The vulnerability arises from the get_user_profile_structure() function assembling a front-end profile buffer that includes raw comment excerpts. This buffer is passed to do_shortcode() after a limited neutralization pass that blocks only specific shortcode fragments but leaves other well-formed shortcodes intact. Authenticated attackers with Subscriber-level privileges can post comments containing arbitrary shortcode markup, which is then executed server-side when visitors load the Comments tab of the target's front-end profile. This allows attackers to execute shortcodes from any active plugin or theme with attacker-chosen attributes, potentially exposing sensitive data or injecting malicious HTML.

An attacker with authenticated Subscriber-level access can inject arbitrary shortcodes into comments, which are executed server-side when the profile Comments tab is viewed. This can lead to unauthorized exposure of capability-gated or sensitive data and injection of raw HTML into publicly accessible pages. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), indicating limited confidentiality and integrity impact without availability impact. There are no known exploits in the wild at this time.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or monitor Subscriber-level user comment capabilities and consider disabling or limiting the display of comments containing shortcodes on front-end profiles to reduce exposure.