CVE-2026-85658: ProfilePress WordPress Plugin RCE Vulnerability

CVE-2026-85658 Overview

CVE-2026-85658 affects the ProfilePress plugin for WordPress, a widely deployed membership, login, and user profile solution formerly known as WP User Avatar. The plugin passes an unvalidated user-controlled value directly to WordPress's do_shortcode function. Authenticated attackers with subscriber-level access or higher can execute arbitrary shortcodes on the site. Depending on the shortcodes registered by other installed plugins and themes, this can lead to information disclosure, content manipulation, or execution of privileged administrative actions. All versions of ProfilePress up to and including 4.17.2 are affected. The issue is tracked as CWE-94: Improper Control of Generation of Code.

Critical Impact

Authenticated subscribers can trigger arbitrary shortcode execution, enabling abuse of any other plugin or theme shortcode registered on the WordPress site.

Affected Products

• ProfilePress plugin for WordPress (also distributed as wp-user-avatar)
• All versions up to and including 4.17.2
• WordPress sites permitting subscriber-level registration

Discovery Timeline

• 2026-09-19 - CVE-2026-85658 published to the National Vulnerability Database
• 2026-09-21 - Last updated in NVD database
• Patch released - ProfilePress 4.17.3 shipped via WordPress changeset 3682619

Technical Details for CVE-2026-85658

Vulnerability Analysis

The vulnerability is a code injection flaw in the shortcode handling logic of ProfilePress. WordPress's do_shortcode function parses and executes any registered shortcode contained within a string. When plugins pass attacker-controlled input to this function without validating or restricting allowed shortcodes, the caller inherits the privileges and behaviors of every shortcode registered on the site. In this case, an authenticated request handler processes a value from the request and hands it to do_shortcode without checking whether the current user should be permitted to invoke arbitrary shortcodes. A subscriber-level account, which is the lowest authenticated role and is often available through open registration, is sufficient to reach the vulnerable code path.

Root Cause

The root cause is missing input validation before shortcode expansion. Vendor source references point to shortcode builder and profile rendering paths, including src/ShortcodeParser/Builder/FrontendProfileBuilder.php, src/ShortcodeParser/FrontendProfileTag.php, src/Classes/EditUserProfile.php, and helper logic in src/Functions/GlobalFunctions.php. The remediation appears in changeset 3682604, which constrains the values passed into shortcode expansion.

Attack Vector

Exploitation is network-based and requires authentication as a subscriber or higher. An attacker registers or uses an existing low-privilege account, then submits a crafted request to the vulnerable ProfilePress endpoint. The submitted value contains one or more WordPress shortcodes. When the plugin processes the request, do_shortcode renders the attacker's payload server-side under the plugin's execution context. The realized impact depends on which shortcodes are registered by other components on the target site, and can range from leaking gated content to invoking administrative actions exposed through third-party shortcodes.

No public exploit code is currently listed for this issue. See the Wordfence vulnerability report for additional context.

Detection Methods for CVE-2026-85658

Indicators of Compromise

• Requests from subscriber-level accounts to ProfilePress edit-profile or frontend profile endpoints containing shortcode syntax such as [ and ] in field values.
• Unexpected new administrator accounts, option changes, or content additions correlated with authenticated ProfilePress traffic.
• Web server access logs showing POST requests to wp-admin/admin-ajax.php or ProfilePress profile handlers with URL-encoded shortcode brackets (%5B, %5D) in parameters.

Detection Strategies

• Inspect ProfilePress request parameters for embedded shortcode tokens submitted by non-administrative users.
• Compare the installed wp-user-avatar plugin version against 4.17.3 and flag any host still running 4.17.2 or earlier.
• Correlate authenticated ProfilePress requests with subsequent privileged actions such as role changes, option updates, or file writes.

Monitoring Recommendations

• Enable WordPress audit logging for user role changes, option updates, and plugin/theme modifications.
• Alert on newly created accounts followed shortly by profile update requests containing shortcode syntax.
• Monitor outbound requests from the WordPress host that could indicate shortcode-driven data exfiltration or webhook abuse.

How to Mitigate CVE-2026-85658

Immediate Actions Required

• Upgrade ProfilePress (wp-user-avatar) to version 4.17.3 or later on every affected WordPress site.
• Audit existing subscriber and higher-role accounts, and remove any that were created but are not legitimate.
• Review recent changes to WordPress options, roles, users, and content for signs of shortcode-driven abuse.

Patch Information

The vendor addressed the flaw in ProfilePress 4.17.3. The fix is committed in WordPress changeset 3682604 and packaged in the release tagged by changeset 3682619. Administrators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

• Disable open user registration or restrict the default role to a non-privileged custom role until the patch is applied.
• Temporarily deactivate the ProfilePress plugin on sites that cannot be updated immediately.
• Deploy a web application firewall rule to block shortcode brackets in ProfilePress profile update parameters submitted by low-privilege users.

# Update ProfilePress via WP-CLI to the patched release
wp plugin update wp-user-avatar --version=4.17.3

# Verify the installed version
wp plugin get wp-user-avatar --field=version

# Optional: restrict default registration role while patching a fleet
wp option update default_role subscriber
wp option update users_can_register 0