Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:profilepress:profilepress:*:*:*:*:*:wordpress:*:*

2 briefs RSS
high advisory

Sensitive Information Exposure in ProfilePress Plugin

The ProfilePress plugin for WordPress (<= 4.17.4) is vulnerable to sensitive information exposure, allowing authenticated and unauthenticated attackers to extract user PII via crafted shortcode parameters.

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress web-application-vulnerability wordpress cve
2t 1c
high advisory

Unauthenticated Remote Code Execution in ProfilePress WordPress Plugin

The ProfilePress WordPress plugin contains an unauthenticated RCE vulnerability (CVE-2026-66047) caused by a predictable 32-bit connect token in the AJAX handler, allowing remote attackers to install malicious plugins.

ProfilePress
1r 2t 1c