CVE-2025-8878: ProfilePress WordPress Plugin RCE Flaw

CVE-2025-8878 Overview

CVE-2025-8878 affects the ProfilePress plugin for WordPress, a paid membership, ecommerce, and user registration solution. The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes through the plugin's registration and profile handling logic. The flaw exists in all versions up to and including 4.16.4. The root cause is improper validation of user-supplied values before they reach the do_shortcode function. Attackers can leverage this behavior to invoke shortcodes without authentication, potentially exposing restricted content or triggering unintended plugin actions. The issue is categorized under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can invoke arbitrary WordPress shortcodes, enabling content exposure and abuse of shortcode-driven functionality on affected sites.

Affected Products

ProfilePress plugin for WordPress (all versions ≤ 4.16.4)
WordPress sites using the wp-user-avatar / ProfilePress registration flow
WordPress sites using ProfilePress frontend profile shortcode builder

Discovery Timeline

2025-08-16 - CVE-2025-8878 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8878

Vulnerability Analysis

The vulnerability resides in the ProfilePress plugin's handling of user-supplied values that are passed to WordPress's do_shortcode function. The plugin exposes actions that accept input from HTTP requests without properly validating or sanitizing the content before shortcode expansion. Because do_shortcode parses and executes any registered shortcode found in a string, an attacker who controls the input can force execution of shortcodes registered by the site or its plugins. The affected code paths are visible in RegistrationAuth.php and multiple locations in FrontendProfileBuilder.php within the plugin source.

Root Cause

The root cause is missing input validation prior to shortcode processing, classified as [CWE-94] Improper Control of Generation of Code. The plugin trusts values reaching the registration and profile handlers and passes them directly into do_shortcode, allowing attacker-controlled shortcode names and attributes to execute. See the WordPress Plugin Code Review and the Frontend Profile Builder source.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to a vulnerable ProfilePress endpoint with a payload containing WordPress shortcode syntax. The plugin passes the payload to do_shortcode without sanitization, causing the shortcode to execute in the site context. Impact depends on which shortcodes are registered on the target site. Attackers can enumerate site content, trigger email-generating shortcodes, or interact with other plugin shortcodes to disclose restricted data.

Code-level details are documented by Wordfence and in the upstream fix changeset.

Detection Methods for CVE-2025-8878

Indicators of Compromise

HTTP POST or GET requests to ProfilePress registration or profile endpoints containing shortcode syntax such as [ and ] in unexpected form fields.
Web server access logs showing unauthenticated requests to wp-user-avatar plugin routes with encoded bracket characters (%5B, %5D).
Unexpected outbound email traffic or content rendering originating from shortcode-triggered plugin actions.

Detection Strategies

Inspect WordPress access logs for requests to ProfilePress endpoints where form parameters contain WordPress shortcode patterns.
Deploy web application firewall (WAF) rules that flag shortcode syntax in unauthenticated request bodies targeting /wp-admin/admin-ajax.php and ProfilePress registration URLs.
Correlate anomalous shortcode-derived output (unexpected HTML fragments, plugin responses) with the source IP submitting the request.

Monitoring Recommendations

Enable verbose logging on the ProfilePress plugin and monitor calls into do_shortcode originating from registration and profile handlers.
Track version inventory of ProfilePress across managed WordPress sites and alert on any instance running 4.16.4 or earlier.
Baseline normal request payload patterns to registration endpoints and alert on payloads containing bracket-encoded shortcode markers.

How to Mitigate CVE-2025-8878

Immediate Actions Required

Update the ProfilePress plugin to a version later than 4.16.4 that includes the fix from changeset 3345295.
Audit WordPress sites for the presence of the ProfilePress or wp-user-avatar plugin and confirm the installed version.
Review recent registration and profile request logs for shortcode payloads and investigate any successful executions.

Patch Information

The maintainers addressed the issue in the upstream changeset 3345295, which adds validation before values reach do_shortcode. Administrators should apply the plugin update through the WordPress dashboard or wp-cli. Full technical context is available in the Wordfence Vulnerability Analysis.

Workarounds

Temporarily deactivate the ProfilePress plugin on sites that cannot be updated immediately.
Add WAF rules to block unauthenticated requests to ProfilePress endpoints containing shortcode delimiters [ and ] or their URL-encoded equivalents.
Restrict access to registration and profile endpoints via IP allowlisting where the business context permits.

bash

# Update ProfilePress via wp-cli to the fixed release
wp plugin update wp-user-avatar
wp plugin get wp-user-avatar --field=version