CVE-2025-13642
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| profilepress | paid_membership_plugin | 4.16.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the ProfilePress WordPress plugin (including Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content) up to version 4.16.7. It allows authenticated users with Subscriber-level access or higher to execute arbitrary shortcodes via the 'pp_preview_form' endpoint due to insufficient input sanitization on the 'type' parameter in the form preview functionality.
How can this vulnerability impact me? :
An attacker with Subscriber-level access or above can exploit this vulnerability to execute arbitrary shortcodes, which may lead to unauthorized actions such as information disclosure or modification of content within the WordPress site. This could compromise the integrity and confidentiality of the site data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your WordPress installation is running the ProfilePress plugin (also known as WP User Avatar) at version 4.16.7 or earlier. Specifically, look for the presence of the `pp_preview_form` endpoint and attempts to access it with the `type` parameter. Monitoring web server logs for authenticated users (Subscriber-level and above) making requests to `pp_preview_form` with unusual or suspicious shortcode payloads can help identify exploitation attempts. There are no specific commands provided in the resources, but you can use tools like `grep` on your web server logs to search for `pp_preview_form` requests, for example: `grep 'pp_preview_form' /var/log/apache2/access.log` or `grep 'pp_preview_form' /var/log/nginx/access.log`. Additionally, checking the plugin version via WordPress admin or command line (WP-CLI) can help: `wp plugin list | grep profilepress`. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the ProfilePress (WP User Avatar) plugin to version 4.16.8 or later, where the vulnerability has been fixed. The fix restricts form preview access strictly to administrators, validates and sanitizes input parameters, and ensures only authorized users can execute shortcodes via the form preview functionality. If updating immediately is not possible, restrict access to the `pp_preview_form` endpoint to trusted administrator users only, and consider disabling the form preview feature temporarily. Also, review user roles and permissions to ensure that Subscriber-level users do not have elevated privileges that could be exploited. [2, 3]