EUVD-2026-95593
GHSA-9j7q-ccvv-gvmw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site with ProfilePress
-
DeliveryIdentify unprotected privileged action
-
ExploitSend crafted unauthenticated request
-
ExecutionBypass missing authorization check
-
ImpactModify protected data (integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets a ProfilePress (wp-user-avatar) action protected only by an improperly configured access-control/security-level check (CWE-862 Missing Authorization), per the vendor description 'Incorrectly Configured Access Control Security Levels.' Per CVSS PR:N/UI:N, no authentication or user interaction is required and the attack is network-reachable against affected installations up to and including version 4.17.3. The key LIMITING factor is CVSS AC:H (HIGH complexity): a specific configuration state or condition must hold for the authorization gap to be reachable, so default installations may not be uniformly exploitable. Impact is limited to integrity (I:H); no confidentiality or availability loss is indicated. |
| Impact | This is a moderate-severity, high-CVSS-but-tempered-real-risk issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, base 5.9) indicates a network-reachable, unauthenticated flaw with HIGH attack complexity and impact confined to integrity only (no confidentiality or availability loss). The CWE-862 Missing Authorization classification and the Patchstack reference ('broken access control') are consistent with the description. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit (POC) is indicated - so exploitation signals are absent. The HIGH attack complexity materially lowers practical risk versus a typical AC:L broken-access-control bug, suggesting a specific state or race/condition must be met rather than a trivial direct request. Net: patch during normal cycles for exposed WordPress sites, but this is not an emergency. MISSING DATA: EPSS probability is not supplied and cannot be used to gauge likelihood; the exact protected action/endpoint behind the missing authorization is not described, so the integrity impact scope is inferred from CVSS (I:H) rather than confirmed by vendor detail. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker crafts a request to a ProfilePress (wp-user-avatar) action that fails to enforce an authorization check, modifying data or state they should not control. Because CVSS specifies HIGH attack complexity (AC:H), success likely depends on a particular configuration or timing condition rather than a single trivial request. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
ProfilePress versions up to and including 4.17.3 contain a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass incorrectly configured access control checks, potentially leading to unauthorized modification of site data. The flaw requires a specific high-complexity configuration condition (CVSS AC:H) to be exploitable, but when present, it can compromise integrity; confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score is 5.9, reflecting a moderate-severity, high-CVSS-but-tempered-real-risk issue.
RemediationAI
No vendor-released patch has been identified at the time of analysis. Users should monitor the Patchstack advisory for an official fix and upgrade as soon as a patched version becomes available. As a compensating control, review and correct the access control and security-level configurations within ProfilePress-ensure that no custom roles or permissions inadvertently grant unauthorized access to protected actions. Restrict access to plugin-related endpoints to trusted IP addresses or authenticated users where feasible, though this may impact legitimate functionality. Because exploitation requires a specific high-complexity configuration (CVSS AC:H), auditing and hardening the plugin's configuration significantly reduces risk. Note that these mitigations are not a substitute for a vendor patch and may have side effects on site operation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in ProfilePress (also known as wp-user-avatar), a popular WordPress plugin for user registration, login, and profile management. The root cause is classified as CWE-862 Missing Authorization, where an action or endpoint lacks proper authorization checks, relying instead on an incorrectly configured access control or security-level setting. According to the vendor description, the issue stems from 'Exploiting Incorrectly Configured Access Control Security Levels.' The affected component is the entire plugin, as indicated by CPE cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:*:*:* covering all versions through 4.17.3. The attack vector is network-reachable (AV:N) with no authentication (PR:N) or user interaction (UI:N) required, but the high attack complexity (AC:H) indicates that a specific configuration state must hold for exploitation, limiting the scope to installations with particular misconfigurations. Successful exploitation impacts only integrity (I:H), allowing modification of data, while confidentiality and availability remain unaffected.
Know when Profilepress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable, unauthenticated missing-authorization flaw (AV:N/PR:N); AC:H reflects the condition-dependent trigger; impact limited to integrity (I:H), no C or A.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Profilepress
View allA vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress Word
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress Wo
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePr
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfileP
Stored shortcode injection in the ProfilePress WordPress plugin before 4.17.1 allows unauthenticated attackers to persis
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data para
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape
The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login
The User Registration, User Profile, Login & Membership - ProfilePress (Formerly WP User Avatar) WordPress plugin before
The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4
Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote at
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plu
Exploit-DB