Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.11. This is due to the plugin allowing user-supplied billing field values from the checkout process to be interpolated into shortcode template strings that are subsequently processed without proper sanitization of shortcode syntax. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting crafted billing field values during the checkout process.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-04 | 2 | Disclosure2 |
| 2026-04-11 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-3309-wp-user-avatar-version-4-16-11-medium-vulnerability-proof-of-concept CVE-2026-3309 #WordPress plugin #vulnerability wp-user-avatar #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post announces a proof‑of‑concept for CVE‑2026‑3309 affecting the WordPress wp‑user‑avatar plugin, linking to the PoC via AtomiceEdge.
CVE-2026-3309 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrar… https://www.cve.org/CVERecord?id=CVE-2026-3309
Post summary
The excerpt announces CVE‑2026‑3309, highlighting that the ProfilePress WordPress plugin is vulnerable, but provides no further details on exploits, patches, or active use.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3309 - Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Chec… https://ift.tt/CFf7Zsi
Post summary
The alert announces CVE-2026-3309 affecting ProfilePress version <=4.16.11, describing an unauthenticated arbitrary shortcode execution vulnerability.