CVE-2026-18385 describes a code injection vulnerability (CWE-94) in the ProfilePress WordPress plugin that enables authenticated attackers with subscriber-level privileges or higher to execute arbitrary shortcodes. The root cause is insufficient validation of user-controlled input before invoking the do_shortcode function. Although some shortcode tags like [profile-first-name] and [profile-last-name] are partially mitigated by strip_shortcodes(), bypasses exist via the [profile-display-name format="first_last_names"] path, the [profile-bio] path which re-fetches raw meta descriptions, and the double-bracket escape sequence [[tag]]. These bypasses allow malicious shortcode content to reach the outer do_shortcode call, enabling code injection.

An attacker with subscriber-level access or above can execute arbitrary shortcodes within the WordPress environment, potentially leading to limited confidentiality and integrity impact. The CVSS score of 5.4 (medium severity) reflects that the vulnerability requires low attack complexity and privileges but results in limited impact on confidentiality and integrity, with no impact on availability. There are no known exploits in the wild at this time.

No official patch or remediation has been confirmed yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting subscriber-level user capabilities or monitoring for suspicious shortcode usage if feasible. Avoid relying solely on partial mitigations such as strip_shortcodes() as bypasses exist.