Unauthenticated Remote Code Execution in ProfilePress WordPress Plugin

The ProfilePress WordPress plugin (formerly wp-user-avatar) versions prior to 4.17.2 are vulnerable to an unauthenticated remote code execution exploit identified as CVE-2026-66047. The vulnerability exists within the ppress_connect_process AJAX handler, which utilizes a weak 32-bit connect token for authentication. Attackers can brute-force this token to bypass authorization and interface with the handler. Once the token is discovered, an attacker can supply a malicious URL via the file request parameter, instructing the server to download and activate a ZIP file containing a WordPress plugin of the attacker's choosing. This process results in arbitrary PHP code execution within the context of the web-server user. This vulnerability is critical for WordPress administrators as it provides a trivial path to full site compromise without requiring any prior authentication.

Impact

Successful exploitation allows unauthenticated attackers to achieve arbitrary code execution on the underlying server. This can lead to full site takeover, unauthorized access to sensitive database information, exfiltration of user data, and potential lateral movement within the hosting environment. All WordPress sites running versions of ProfilePress prior to 4.17.2 are at risk.

Recommendation

• Update the ProfilePress WordPress plugin to version 4.17.2 or later immediately.
• Monitor webserver access logs for high-frequency POST requests to the 'admin-ajax.php' endpoint, specifically targeting the 'ppress_connect_process' action, which may indicate a brute-force attempt against the 32-bit connect token.
• Review installed WordPress plugins for unauthorized additions or suspicious activity originating from the plugin directory.