CVE-2026-104003 properfraction CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP User Avatar / ProfilePress plugin, especially those allowing user comments, should assess exposure and prioritize verification of their systems.

Why it matters

The WP User Avatar / ProfilePress plugin vulnerability allows authenticated attackers to inject arbitrary shortcodes, potentially leading to capability-gated or data-returning shortcode execution and raw HTML markup injection.

• Authenticated attackers with Subscriber-level access can inject arbitrary shortcodes
• Shortcodes can be executed server-side when a visitor loads the target's front-end profile Comments tab
• Attackers can reach capability-gated or data-returning shortcodes and inject raw HTML markup into a publicly viewable page

Technical summary

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pass (ppress_neutralize_buffer_shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters but leaves any other well-formed shortcode intact.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the WP User Avatar / ProfilePress plugin, especially those allowing user comments, and assess the impact of arbitrary shortcode execution on their systems.

Recommended defensive actions

• Verify WordPress installations for the WP User Avatar / ProfilePress plugin version 4.17.5 or earlier
• Assess user comment policies and restrict comment posting to trusted users
• Implement Content Security Policy (CSP) to restrict shortcode execution
• Monitor for suspicious shortcode execution and update the plugin to a fixed version when available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source references provide details on the vulnerability, including the affected plugin version and the functions involved in the vulnerability. The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a p

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.