Security Alert Summary
The WP User Avatar / ProfilePress plugin for WordPress contains an arbitrary shortcode execution vulnerability (CVE-2026-104003) in versions up to and including 4.17.5. An authenticated user with Subscriber-level access or higher can post a comment containing shortcode markup. The plugin assembles front-end profile content that includes raw comment excerpts and passes that buffer to do_shortcode() after a limited neutralization step, allowing other well-formed shortcodes to execute when a visitor views the profile Comments tab.
CVE Details
- CVE ID:
CVE-2026-104003 - Affected component: WP User Avatar / ProfilePress plugin (front-end profile rendering)
- Affected versions: Versions up to and including 4.17.5
- Published: October 16, 2026 at 09:17:03 AM
- Last modified: October 16, 2026 at 03:17:03 PM
- CVSS v3.1: Base Score 5.4, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Authentication / privileges / user interaction: Authenticated attack required; privileges required: LOW (authenticated user such as Subscriber-level); user interaction: NONE
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-94 (Improper Control of Generation of Code)
Technical Details
This issue arises in the plugin when the function get_user_profile_structure() builds the front-end profile buffer. That buffer includes raw comment excerpts inlined by author_comment_query(). The assembled buffer is then passed to WordPress’ do_shortcode() after a narrow neutralization pass performed by ppress_neutralize_buffer_shortcodes. That neutralization blocks the pp-custom-html shortcode and bracket fragments containing HTML delimiters but leaves other well-formed shortcodes intact.
Because comments from authenticated users can contain shortcode markup, an attacker with Subscriber-level access or higher can post a comment that includes a shortcode from any active plugin or theme. When a visitor loads the target user’s front-end profile Comments tab, the shortcode is executed server-side. This allows the attacker to invoke shortcodes that return data or render capability-gated content, and to inject raw HTML into the publicly viewable page.
How This Could Impact Your Website
Consider a small WordPress site where the site owner, an internal editor, and one or more external contributors interact. If an authenticated contributor or external contractor with Subscriber-level access posts a comment containing shortcode markup, that shortcode may execute when any visitor views the affected user’s profile Comments tab. The practical consequences include limited disclosure of data returned by executed shortcodes and the possibility of attacker-controlled HTML appearing on a public page.
Realistic impacts include exposure of internal user metadata or other data returned by shortcodes and an increased risk of targeted phishing or social engineering if attacker-supplied content reveals or formats user contact information. The vulnerability does not imply full site compromise based on the provided data, but it does raise the chance that capability-gated shortcodes could be reached by an attacker-supplied input vector.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor and Subscriber accounts that do not need commenting or profile edit capabilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes to reduce the set of shortcodes that could be abused.
- Monitor site activity and logs for unusual behavior, especially new comments containing unexpected shortcode markup.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://pastebin.com/raw/pCgrW6Pf
- https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/Functions/GlobalFunctions.php#L1768
- https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L169
- https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/ShortcodeParser/FrontendProfileTag.php#L142
- https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/Themes/DragDrop/UserProfile/DefaultTemplate.php#L379
- https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.6/src/ShortcodeParser/FrontendProfileTag.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/83adfbff-f625-4474-81b9-961c496d59a0?source=cve
