CVE-2026-66047

High

Description

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.

SeverityHigh

CVSS8.1

Exploit probability—

Product

ProfilePress

PublishedAug 31, 2026

First seenAug 31, 2026

Weakness typeCWE-306Missing authentication for critical function CWE-330CWE-330

How to fix

Update

Proper Fraction ProfilePress4.17.2 or later

Patches

profilepress.com/changelog/

Affected products

Product	Affected versions	Fixed in
Proper Fraction ProfilePress	v < 4.17.2	4.17.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.