← Back to the live CVE advisory feed

CVE-2026-66047: ProfilePress

Severity

9.2 (CRITICAL)

Vendor

PROPER FRACTION

Affected versions

0 through before 4.17.2

Fixed version

4.17.2

Patch status

Patched

Published

2026-08-31T15:17:37.503

Modified

2026-08-31T15:17:37.503

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Check whether the affected WordPress plugin or theme is installed.
• Update to version 4.17.2, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.

View the official NVD record for CVE-2026-66047

AI-enriched (MEDIUM confidence). Validate against the vendor advisory before taking production action.