CVE-2026-96337: WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

Q: Which ProfilePress versions are affected?

The issue affects ProfilePress versions through 4.17.3. The available data does not identify a fixed version.

Q: What level of access does an attacker need?

An attacker needs low-level privileges to exploit the issue. The vector is network-accessible, requires no user interaction, and has low attack complexity.

Q: What is the likely security impact?

The reported impact is integrity-only: an attacker may be able to modify data or perform unauthorized actions. No confidentiality or availability impact is indicated by the supplied vector.

Published Oct 9, 2026

Updated

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3.

Affected Software

1 affected component

ProfilePress ProfilePress<=4.17.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress ProfilePress plugin to a version that resolves this vulnerability.
Fixed in 4.17.4

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which ProfilePress versions are affected?

The issue affects ProfilePress versions through 4.17.3. The available data does not identify a fixed version.

What level of access does an attacker need?

An attacker needs low-level privileges to exploit the issue. The vector is network-accessible, requires no user interaction, and has low attack complexity.

What is the likely security impact?

The reported impact is integrity-only: an attacker may be able to modify data or perform unauthorized actions. No confidentiality or availability impact is indicated by the supplied vector.

CVE-2026-96337: WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which ProfilePress versions are affected?

What level of access does an attacker need?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

Which ProfilePress versions are affected?

What level of access does an attacker need?

What is the likely security impact?