CVE-2026-66047

ProfilePress (wp-user-avatar), a WordPress membership and user-profile plugin, contains an unauthenticated remote code execution vulnerability in its ppress_connect_process AJAX handler, fixed in version 4.17.2. The handler authenticates requests using a weak 32-bit connect token that can be brute-forced, and a caller-controlled URL supplied in the 'file' request parameter then causes the site to silently install and activate an arbitrary plugin. Because activating an attacker-chosen plugin executes its PHP code, this results in arbitrary PHP code execution on the server as the web-server user, with no authentication or user interaction required. Any WordPress site running ProfilePress/wp-user-avatar before 4.17.2 whose AJAX endpoint is reachable is affected; the CVSS 4.0 score of 9.2 reflects high network exposure and high impact with elevated attack complexity due to the token brute-force. As of this writing there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a roughly 0.5% probability of exploitation within 30 days.

What to do: Update ProfilePress (wp-user-avatar) to version 4.17.2 or later as soon as possible. Sites that cannot patch immediately should block or rate-limit unauthenticated admin-ajax.php requests with action=ppress_connect_process (e.g., via WAF rules) and review the installed plugin list for unexpected additions or activations. Also check access logs for repeated calls to this AJAX action, which may indicate token brute-forcing or prior compromise, and monitor for disclosure of public exploit code.