CVE-2026-66047
Received Received - Intake

Unauthenticated Remote Code Execution in ProfilePress WordPress Plugin

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-66047
EUVD
EUVD-2026-68577

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
profilepress wp_user_avatar to 4.17.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated remote code execution flaw in the ProfilePress WordPress plugin before version 4.17.2. Attackers can exploit a weak 32-bit connect token via the ppress_connect_process AJAX handler to install and activate arbitrary plugins without authentication. By supplying a controlled URL through the file request parameter, they can silently trigger plugin installation and activation, leading to PHP code execution as the web server user.

Detection Guidance

Check if the ProfilePress plugin version is below 4.17.2. Inspect WordPress logs for unusual AJAX requests to ppress_connect_process. Monitor for unexpected plugin installations or activations in the WordPress admin panel.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your server, potentially leading to full system compromise. They could steal sensitive data, install malware, deface your website, or use your server for further attacks. Since it requires no authentication, any unpatched instance is at high risk of exploitation.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting personal and health data. Unauthorized code execution may expose sensitive user information, resulting in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Update the ProfilePress plugin to version 4.17.2 or later immediately. Disable the ppress_connect_process AJAX handler if not required. Review and remove any unauthorized plugins installed recently.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66047. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart