Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress
CVE-2026-13352
|
EUVD-2026-45134
HIGH
GHSA-6x2r-8q58-rj53
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 17, 2026
Remote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) in all versions through 4.16.18, where the DigitalProducts UploadHandler unconditionally registers an upload_mimes filter that whitelists executable extensions (.exe, .apk, .msi) across every WordPress upload context site-wide. Authenticated attackers with author-level access or above (per CVSS PR:L) can leverage this expanded MIME allowlist to upload executable files, leading to code execution. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_mime_types function. This is due to the unconditional registration of an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the global WordPress MIME allowlist, without scoping the expansion to digital-product upload contexts. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible. This filter is registered globally on every request regardless of whether the digital products feature is configured or in use, meaning the expanded MIME allowlist affects all WordPress upload contexts site-wide.
Executive ViewAI
ProfilePress WordPress plugin (versions through 4.16.18) contains a file upload vulnerability allowing server compromise for organizations with delegated content management. No public exploit has been identified at this time, but the attack vector is straightforward, requiring only compromised author-level credentials. Immediate action to restrict permissions and identify affected installations is essential.
Within 24 hours: audit all WordPress installations using ProfilePress to identify affected versions (4.16.18 and below) and document which users have author or administrator roles with upload capabilities. Within 7 days: restrict upload permissions to administrator-only accounts, disable ProfilePress upload features if not essential, and monitor for vendor security updates. Within 30 days: establish a quarterly access review process for author-level privileges and develop a contingency plan for rapid deployment once a vendor patch becomes available.
Restrict author and editor roles to trusted staff only. Disable plugin file upload functionality if not in active use. Implement file type validation at Web Application Firewall layer to block executable uploads (.exe, .apk, .msi, .bat, .cmd, .com, .pif, .scr, .vbs). Monitor wp-content/uploads directory for unexpected executable files. Require administrator approval for any new author account creation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress
View allSensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and i
Authenticated users with subscriber-level access or higher can execute arbitrary WordPress shortcodes through the Profil
Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordP
Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated a
Reflected cross-site scripting (XSS) in the ProfilePress WordPress plugin versions up to and including 4.17.4 allows una
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attacker
Arbitrary shortcode execution in the ProfilePress (formerly WP User Avatar) WordPress plugin through version 4.17.5 allo
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attacke
Exploit-DB