CVE-2026-66047: Critical severity ProfilePress wp-user-avatar vulnerability
ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ProfilePress (wp-user-avatar) WordPress pluginto a version that resolves this vulnerability.Fixed in 4.17.2 - Compensating control
Block or restrict access to the WordPress AJAX handler used by the vulnerable endpoint (ppress_connect_process) from unauthenticated users until the plugin is upgraded, e.g., via WAF rules or firewall/ACLs on /wp-admin/admin-ajax.php?action=ppress_connect_process.
Event History
Frequently Asked Questions
Which deployments are exposed?
WordPress sites running the ProfilePress (wp-user-avatar) plugin before version 4.17.2 are affected. Exploitation is reachable remotely through the ppress_connect_process AJAX handler without authentication.
What does an attacker need to exploit this issue?
The attacker does not need a WordPress account or user interaction. They must brute-force the weak 32-bit connect token and provide a URL in the file request parameter.
What is the likely impact of successful exploitation?
An attacker can silently install and activate an arbitrary plugin, resulting in PHP code execution as the web-server user. The vulnerability can affect confidentiality, integrity, and availability.
How can I determine whether my site may already be affected?
Review whether ProfilePress is installed and running a version earlier than 4.17.2. Also inspect installed and active plugins for unexpected additions, particularly plugins that may have been installed without administrator action.
What should be done if an immediate update is not possible?
The provided information identifies the vulnerable AJAX handler and its unauthenticated nature, but does not provide a documented workaround. Prioritize updating ProfilePress to version 4.17.2 or later and investigate unexpected plugin installations.