CVE-2026-92536 properfraction CVE debrief

Who should care

Defenders responsible for WordPress installations with the ProfilePress plugin, especially those with user registration and directory features, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-92536 is a Sensitive Information Exposure vulnerability in the ProfilePress plugin for WordPress. Defenders should prioritize verifying exposure, assessing impact, and remediating affected systems, especially those with user registration and directory features.

• Authenticated attackers can extract sensitive user information
• Potential for lateral movement and further exploitation
• Need for verification of affected versions and configurations
• Priority for updating to a patched version

Technical summary

The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4. The vulnerability allows authenticated attackers to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those with user registration and directory features. The CVE record and NVD entry provide details on the vulnerability, but further source-

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those with user registration and directory features.

Recommended defensive actions

• Verify the version of the ProfilePress plugin and update to a patched version if necessary
• Assess the configuration of the Member Directory and restrict access to sensitive information
• Monitor user activity and logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in version 4.17.4 of the ProfilePress plugin. The CVE record and NVD entry provide details on the vulnerability, but further verification is needed to determine the full scope of affected versions and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.