ProfilePress CVE-2026-41556

Exploitation requires: (1) the target WordPress site must have the ProfilePress plugin installed and active in versions ≤ 4.16.13; (2) the attacker must possess or obtain at minimum a subscriber-level WordPress account on the target site - open registration (the WordPress default) satisfies this; (3) a higher-privileged user (e.g., administrator or editor) must interact with content rendered from the subscriber's profile, such as visiting a profile page or an admin panel section that displays subscriber data. Exploitation is limited by the UI:R requirement - passive, unvisited payloads do not execute. Sites that have disabled all user registration or restrict profile visibility to the profile owner only have a materially reduced attack surface.

The CVSS base score of 6.5 (Medium) reflects a real but bounded risk. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-accessible exploitation with low complexity, but requires both a low-privilege account (subscriber registration) and victim interaction (an admin or privileged user must view the injected content). The scope change is the most significant threat amplifier: a subscriber could potentially hijack an administrator session, escalate privileges, or plant persistent backdoors through admin-side script execution. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC code is referenced. Patchstack, a reputable WordPress-focused security vendor, is the reporting source, which increases confidence in the finding's validity. The requirement for UI:R limits automated, mass exploitation but does not eliminate targeted abuse on sites with active admin users.

An attacker registers a free subscriber account on a vulnerable WordPress site running ProfilePress ≤ 4.16.13, then inserts a JavaScript payload (e.g., a cookie-stealing script or admin action forger) into a profile field that lacks proper output encoding. When a site administrator or privileged user views the subscriber's profile page, the payload executes in their browser context, potentially allowing session token theft, unauthorized administrative actions, or persistent backdoor installation via admin-accessible plugin or theme editors. No public POC has been identified at time of analysis.