CVE-2026-96337: WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress ProfilePress pluginto a version that resolves this vulnerability.Fixed in 4.17.4
Event History
Frequently Asked Questions
Which ProfilePress versions are affected?
The issue affects ProfilePress versions through 4.17.3. The available data does not identify a fixed version.
What level of access does an attacker need?
An attacker needs low-level privileges to exploit the issue. The vector is network-accessible, requires no user interaction, and has low attack complexity.
What is the likely security impact?
The reported impact is integrity-only: an attacker may be able to modify data or perform unauthorized actions. No confidentiality or availability impact is indicated by the supplied vector.