CVE-2026-92536: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress userscanregister option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the regnickname and regbio fields without a nonce requirement.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. If the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit it through the plugin's registration handler.
What information can an attacker obtain?
An attacker can extract other users' email addresses, login names, and registration dates through the Member Directory.
What conditions are required for unauthenticated exploitation?
WordPress user registration must be enabled through the users_can_register option. The attacker can then supply shortcode fragments through the registration handler's reg_nickname and reg_bio fields, which are processed without a nonce requirement.
Which versions are affected?
All ProfilePress versions up to and including 4.17.4 are affected.