CVE-2026-66047CWE-306CWE-330

CVE-2026-66047

High · published August 31, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
60.0
In the wild
Unconfirmed
What it is

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00924 · 60.0th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-330 · Use of Insufficiently Random Values
Published
2026-08-31T19:17Z
References (3)
https://profilepress.com/changelog/ · [email protected]https://wordpress.org/plugins/wp-user-avatar/ · [email protected]https://www.vulncheck.com/advisories/profilepress-wordpress-plugin-unauthenticated-arbitrary-plugin-installation-rce · [email protected]
EPSS history
Timeline
  • 02 SEP 03:38Z
    EPSS moved — → 1%
    epss
  • 31 AUG 14:46Z
    ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE
    cvelistv5