Cpe:2.3:a:profilepress:profilepress:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aprofilepressprofilepresswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 31 Aug 2026 15:58:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated Remote Code Execution in ProfilePress WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-08-profilepress-rce/Mon, 31 Aug 2026 15:58:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-profilepress-rce/The ProfilePress WordPress plugin contains an unauthenticated RCE vulnerability (CVE-2026-66047) caused by a predictable 32-bit connect token in the AJAX handler, allowing remote attackers to install malicious plugins.The ProfilePress WordPress plugin (formerly wp-user-avatar) versions prior to 4.17.2 are vulnerable to an unauthenticated remote code execution exploit identified as CVE-2026-66047. The vulnerability exists within the ppress_connect_process AJAX handler, which utilizes a weak 32-bit connect token for authentication. Attackers can brute-force this token to bypass authorization and interface with the handler. Once the token is discovered, an attacker can supply a malicious URL via the file request parameter, instructing the server to download and activate a ZIP file containing a WordPress plugin of the attacker's choosing. This process results in arbitrary PHP code execution within the context of the web-server user. This vulnerability is critical for WordPress administrators as it provides a trivial path to full site compromise without requiring any prior authentication.

Impact

Successful exploitation allows unauthenticated attackers to achieve arbitrary code execution on the underlying server. This can lead to full site takeover, unauthorized access to sensitive database information, exfiltration of user data, and potential lateral movement within the hosting environment. All WordPress sites running versions of ProfilePress prior to 4.17.2 are at risk.

Recommendation

  • Update the ProfilePress WordPress plugin to version 4.17.2 or later immediately.
  • Monitor webserver access logs for high-frequency POST requests to the 'admin-ajax.php' endpoint, specifically targeting the 'ppress_connect_process' action, which may indicate a brute-force attempt against the 32-bit connect token.
  • Review installed WordPress plugins for unauthorized additions or suspicious activity originating from the plugin directory.
]]>highadvisory