ProfilePress < 4.17.2 - Unauthenticated Arbitrary Plugin Installation RCE

A new ProfilePress vulnerability, tracked as CVE-2026-66047, affects the WordPress plugin distributed under the wp-user-avatar slug before version 4.17.2. The issue is important because ProfilePress is a membership, registration, profile, ecommerce, and access-control plugin with more than 100,000 active installations on WordPress.org.

The CVE record describes an unauthenticated remote code execution path through the plugin’s connect workflow. Administrators running ProfilePress should update to 4.17.2 or newer immediately and review the site for unexpected plugin installation or activation activity.

Vulnerability summary

• Plugin: ProfilePress, formerly WP User Avatar
• WordPress.org slug: wp-user-avatar
• CVE: CVE-2026-66047
• Affected versions: ProfilePress before 4.17.2
• Fixed version: 4.17.2
• Severity: CVSS v3.1 8.1 High; CVSS v4.0 9.2 Critical
• Required privilege: none
• User interaction: none
• Weaknesses: CWE-306 Missing Authentication for Critical Function and CWE-330 Use of Insufficiently Random Values
• CISA KEV: not listed at publication time

Technical cause

The vulnerable path is the ppress_connect_process AJAX action. According to the CVE metadata, the handler lacks a proper authentication boundary and relies on a weak 32-bit connect token. If an attacker guesses the token, the handler can be abused to fetch a caller-controlled plugin package URL, install that plugin, and activate it.

Because activated WordPress plugins execute PHP on the server, successful exploitation can lead to code execution as the web-server user. That level of access commonly allows database credential theft from wp-config.php, webshell persistence under writable paths, account creation, payment-form tampering, SEO spam injection, and broader compromise depending on the host configuration.

Immediate remediation

• Update ProfilePress to 4.17.2 or newer.
• If the site cannot be patched immediately, deactivate ProfilePress until a maintenance window is available.
• Review recently installed or activated plugins, especially anything added after August 26, 2026.
• Inspect wp-content/plugins and wp-content/uploads for unfamiliar PHP files.
• Rotate administrator passwords, invalidate active sessions, and rotate application passwords if there are compromise indicators.
• Put a WAF or web-server block in front of unauthenticated requests to the affected AJAX action while patching is pending.

WP-CLI version check

The plugin’s WordPress.org slug is still wp-user-avatar, so use that slug when checking or updating with WP-CLI:

wp plugin get wp-user-avatar --fields=name,version,status
wp plugin update wp-user-avatar
wp plugin get wp-user-avatar --field=version

Compromise checks

Use these checks to identify unexpected plugin changes and suspicious PHP files. Treat findings as leads for manual review, not automatic proof of exploitation.

wp plugin list --fields=name,status,version,update
find wp-content/plugins -maxdepth 2 -type f -name '*.php' -mtime -7 -print
find wp-content/uploads -type f -name '*.php' -print
wp core verify-checksums
wp plugin verify-checksums --all

Also review access logs for unusual volume around the ProfilePress connect action or repeated requests to admin-ajax.php:

grep -Ei 'ppress_connect_process|admin-ajax.php' /var/log/nginx/access.log*
grep -Ei 'ppress_connect_process|admin-ajax.php' /var/log/apache2/access.log*

Temporary mitigation

The correct fix is to update to ProfilePress 4.17.2 or newer. If you need a short maintenance-window mitigation, block the connect action at the WAF or disable the AJAX callback before normal plugin code runs. The following mu-plugin is defensive only and may break ProfilePress license/connect functionality while active:

<?php
/**
 * Temporary mitigation for CVE-2026-66047.
 * Remove after updating ProfilePress to 4.17.2 or newer.
 */
add_action( 'wp_ajax_nopriv_ppress_connect_process', 'wpdeeply_block_profilepress_connect', 0 );
add_action( 'wp_ajax_ppress_connect_process', 'wpdeeply_block_profilepress_connect', 0 );

function wpdeeply_block_profilepress_connect() {
    status_header( 403 );
    wp_die( 'ProfilePress connect endpoint temporarily disabled.', 'Forbidden', array( 'response' => 403 ) );
}

A WAF rule can also challenge or block unauthenticated requests where the request path is /wp-admin/admin-ajax.php and the requested action is ppress_connect_process. Keep that rule scoped so normal WordPress AJAX traffic is not disrupted.

Sources

• OpenCVE: CVE-2026-66047
• WordPress.org plugin page for ProfilePress
• ProfilePress changelog
• VulnCheck advisory