CVE-2026-92536

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: Wordfence

Description

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92536

EUVD

EUVD-2026-91890

Affected Vendors & Products

Vendor	Product	Version / Range
properfraction	Paid	Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

The ProfilePress WordPress plugin up to version 4.17.4 has a vulnerability called Sensitive Information Exposure. It allows authenticated attackers with subscriber-level access or higher to extract other users' email addresses, login names, and registration dates through a specific plugin feature. Unauthenticated attackers can also exploit this if WordPress user registration is enabled by manipulating registration fields.

Detection Guidance

Check WordPress sites running ProfilePress versions up to 4.17.4 for unauthorized access to user data via the [pp-custom-html] shortcode. Inspect logs for base64 payloads in reg_nickname and reg_bio fields if users_can_register is enabled. No specific commands are provided in the context.

Impact Analysis

If you use this plugin, attackers could steal user data like emails and login names. This could lead to phishing attacks, unauthorized access to accounts, or privacy violations. The high CVSS score indicates severe impact including confidentiality, integrity, and availability breaches.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized personal data exposure and HIPAA if user registration data includes protected health information. Organizations using this plugin may face compliance violations, fines, and reputational damage due to data breaches.

Mitigation Strategies

Update ProfilePress to the latest version beyond 4.17.4 immediately. Disable the users_can_register option if not needed. Review user roles to ensure subscriber-level access is restricted. Monitor for suspicious shortcode usage in Member Directory.

Hi! I’m here to help you understand CVE-2026-92536. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70