Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-66047ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

High 8.1

In plain English

A high-severity missing authentication in ProfilePress from Proper Fraction. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.9%top 39.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	wordpress	no fix listed	UBUNTU-CVE-2026-66047
Ubuntu:24.04:LTS	wordpress	no fix listed	UBUNTU-CVE-2026-66047
Ubuntu:26.04:LTS	wordpress	no fix listed	UBUNTU-CVE-2026-66047
Ubuntu:26.10	wordpress	no fix listed	UBUNTU-CVE-2026-66047

Affected products (as reported)

Vendor	Product	Versions
Proper Fraction	ProfilePress	0 – before 4.17.2

Weakness: CWE-306, CWE-330 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Plugin Changelog release-notes, patch
WordPress Plugin Webpage product
https://www.vulncheck.com/advisories/profilepress-wordpress-plugin-unauthenticated-arbitrary-plugin-installation-rce third-party-advisory