CVE-2026-96518: WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/profilepressto a version that resolves this vulnerability.Fixed in 4.17.4
Event History
Frequently Asked Questions
Which ProfilePress versions are affected?
The issue affects ProfilePress wp-user-avatar through version 4.17.3. The provided data does not identify a fixed version.
Can an unauthenticated attacker exploit this issue?
The vector is network-based and the privileges-required metric is none, indicating that authentication is not required. Exploitation has high attack complexity.
What is the likely security impact?
The vulnerability is rated medium severity with a CVSS score of 5.9. It can affect integrity, while no confidentiality or availability impact is indicated.