ProfilePress CVE-2026-66047

Exploitation requires the ProfilePress (wp-user-avatar) plugin, version earlier than 4.17.2, to be installed and active on an internet-reachable WordPress site with admin-ajax.php exposed (the default). The concrete prerequisite is reaching the ppress_connect_process AJAX handler and successfully guessing/brute-forcing its 32-bit connect token, then supplying an attacker-controlled URL in the 'file' request parameter that the server can fetch. Limiting factors: the brute-force step (CVSS AC:H) means success depends on token entropy and any rate-limiting or WAF controls in front of admin-ajax.php, and the target server must be able to make an outbound HTTP fetch of the attacker's plugin package. No authentication (PR:N) and no user interaction (UI:N) are needed.

This is a genuine high-priority issue, not merely a high-CVSS number. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 and reflects unauthenticated, network-reachable, no-user-interaction access with full confidentiality, integrity, and availability impact - consistent with full PHP RCE. The single mitigating factor is AC:H, attributable to the brute-force step needed to guess the 32-bit token; however, 32 bits is weak entropy and, absent strict rate limiting, is practically attackable, so the AC:H should not be read as a strong barrier. No EPSS score was provided, so exploitation-probability modeling cannot be cited here. There is no CISA KEV listing and no public PoC referenced, meaning no confirmed active exploitation - but VulnCheck's advisory and the low-entropy design make this an attractive target for opportunistic mass-exploitation of WordPress sites once tooling appears. Net: treat as urgent-patch given RCE impact and internet-facing exposure, while noting that active-exploitation and EPSS signals are currently absent from the data.

An attacker scans for WordPress sites running vulnerable ProfilePress, then scripts repeated requests to the ppress_connect_process AJAX action to brute-force the 32-bit connect token. Once a valid token is found, they resubmit with the 'file' parameter pointing to a URL hosting a malicious plugin ZIP, causing WordPress to silently install and activate it and execute the attacker's PHP as the web-server user. No public PoC is referenced, but the low token entropy and unauthenticated reach make this readily automatable.