CVE-2026-92536 describes a vulnerability in the ProfilePress WordPress plugin (versions up to and including 4.17.4) that allows sensitive information exposure. The flaw arises from improper handling of shortcode inputs ([pp-custom-html]) that invoke user profile fields such as email, username, and registration date. Authenticated attackers with subscriber-level privileges can leverage this to extract other users' sensitive information via the Member Directory's per-row user rebinding mechanism using attacker-controlled base64 payloads. Furthermore, when the WordPress 'users_can_register' option is enabled, unauthenticated attackers can exploit the vulnerability by submitting split shortcode fragments through the plugin's registration handler, which processes certain fields (reg_nickname and reg_bio) without nonce verification. This leads to unauthorized disclosure of user data.

The vulnerability allows attackers to obtain sensitive user information including email addresses, login names, and registration dates. This exposure affects user privacy and could facilitate further attacks such as phishing or account takeover. Both authenticated users with minimal privileges and unauthenticated users (if registration is enabled) can exploit this issue. The CVSS 3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the 'users_can_register' option if not required, and restrict subscriber-level access where possible. Monitor vendor channels for updates and apply patches promptly once released.