ProfilePress CVE-2026-96337

Requires an authenticated session with at least a low-privilege WordPress account on a site running the ProfilePress (wp-user-avatar) plugin at version 4.17.3 or earlier (PR:L). No user interaction is needed (UI:N) and the request is remote over the network (AV:N) with low complexity (AC:L). The primary limiting factor is the authentication requirement: an attacker must first obtain or register a valid account, so sites that disable open user registration or restrict account creation meaningfully reduce exposure. Impact is confined to integrity (I:H) - unauthorized modification of data - with no direct confidentiality or availability effect per the vector.

This is a moderate-priority issue whose signals are largely consistent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) describes a network-reachable, low-complexity flaw that requires some authenticated privilege (PR:L) and yields a high integrity impact with no confidentiality or availability impact - matching the CWE-862 Missing Authorization root cause (an authenticated low-privilege user can perform actions they should not be authorized for). No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was supplied, so exploitation probability and active-exploitation status cannot be quantified from this input; the absence of these signals is not evidence of safety but it does mean there is no indication of mass exploitation. The single reference is a Patchstack advisory (Patchstack is the reporting source), which is a credible vulnerability intelligence provider for the WordPress ecosystem. Net: a real, patch-worthy broken-access-control bug in an authenticated context, but not currently a drop-everything emergency absent evidence of exploitation. Note a minor tension to verify: the vector states PR:L (authenticated) while the title phrase 'Authentication Bypass' tag implies no auth - treat the CVSS PR:L as authoritative for the privilege requirement and confirm the exact required role with the vendor.

An attacker who already holds a low-privilege authenticated account (e.g., a subscriber-level WordPress user) on a site running ProfilePress 4.17.3 or earlier sends a crafted request to a plugin endpoint that fails to properly check authorization, allowing them to modify data or perform privileged actions they should not be permitted to. The high integrity impact (I:H) suggests the attacker can alter protected resources such as user profile or account data. No public exploit code was identified in the provided data.