Security Alert Summary
The ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that can allow unauthenticated attackers to install and activate arbitrary plugins. The issue is exploitable by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler and supplying a caller-controlled URL through the file request parameter, which can result in PHP code execution as the web-server user.
CVE Details
- CVE ID: CVE-2026-66047
- Affected component: ProfilePress (wp-user-avatar) WordPress plugin
- Affected versions: Versions before 4.17.2 (less than 4.17.2)
- Published: August 31, 2026 at 3:17:37 PM UTC
- Last modified: August 31, 2026 at 3:17:37 PM UTC
- CVSS v3.1: Base Score 8.1, Severity: HIGH
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector: NETWORK
- Attack Complexity: HIGH
- Privileges Required: NONE
- User Interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- CWE / weakness: CWE-306, CWE-330
Technical Details
The plugin exposes an AJAX handler named ppress_connect_process that uses a weak 32-bit connect token to authorize certain remote operations. An attacker can brute-force this short token because of its limited entropy. By sending requests to the handler and supplying a caller-controlled URL via the file request parameter, an attacker can trigger silent installation and activation of plugins. Successfully installing and activating a malicious plugin can result in PHP code execution running as the web-server user.
The vulnerability exists because the connect token is weak and the handler does not provide sufficient authentication or integrity checks to prevent unauthenticated callers from performing privileged actions (plugin install and activate). The description explicitly identifies the ppress_connect_process endpoint and the file parameter as the vectors used to deliver and trigger the unwanted plugin installation.
The impact, as reported, is limited to what an attacker can achieve through installing and activating arbitrary plugins. That may include executing PHP code as the web-server user, but the exact post-exploitation capabilities depend on the environment and available privileges of the web-server account.
How This Could Impact Your Website
On a multisite or single-site WordPress installation where multiple people have roles (site owner, internal staff, external contractors, or content contributors), this vulnerability could be abused by an external attacker who does not need an account. For example, an attacker who obtains remote code execution by installing a malicious plugin could extract internal user details such as email addresses or site configuration files, increasing the risk of targeted phishing or social engineering against staff or contractors.
A realistic scenario: an external attacker brute-forces the weak connect token, installs a plugin that logs or exfiltrates the user database, and then uses collected email addresses to send tailored phishing messages to editors or contractors with valid access. The attacker does not need to be an authenticated WordPress user to initiate this chain if the site runs a vulnerable version.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege roles that can be abused if additional plugin-level functionality is enabled.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected plugin installations or activation events.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
