CVE-2026-13352
HIGH
CVSS 8.8
paid_membership_plugin_ecommerce_user_registration_form_login_form_user_profile_restrict_content_profilepress
Verified Advisory
Arbitrary file upload in the ProfilePress WordPress plugin (CVE-2026-13352)
RCE
WordPress
File Upload
Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress
CVE-2026-13352 is an arbitrary file upload vulnerability in the ProfilePress WordPress plugin affecting all versions up to and including 4.16.18. The plugin unconditionally registers an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the global WordPress MIME allowlist on every request, regardless of whether the digital products feature is in use. Authenticated attackers with Author-level access or above can exploit this to upload executable files, enabling remote code execution.
Affected versions:
- <= 4.16.18
We recommend updating to: 4.16.19.
CVSS 8.8 · our assessment: this_week
Vendor advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb520df-e838-4335-bd4f-97026082a204?source=cve
Details: https://vuln.today/cve/CVE-2026-13352
Verified by vuln.today against published advisories.
Affected versions
- – <= 4.16.18
Fixed in: 4.16.19