CVE-2026-13352: ProfilePress WordPress Plugin RCE Flaw

CVE-2026-13352 Overview

CVE-2026-13352 is an arbitrary file upload vulnerability in the ProfilePress plugin for WordPress, affecting all versions up to and including 4.16.18. The plugin, also known as Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content, unconditionally registers an upload_mimes filter that expands the WordPress MIME allowlist to include executable extensions such as .exe, .apk, and .msi. Authenticated attackers with author-level access or higher can upload potentially executable files, enabling remote code execution on the host. The flaw is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated attackers with author-level privileges can upload executable files site-wide, leading to remote code execution.

Affected Products

ProfilePress plugin for WordPress versions up to and including 4.16.18
WordPress sites using the wp-user-avatar plugin package
Sites with the ProfilePress Digital Products module present, regardless of whether it is configured

Discovery Timeline

2026-07-17 - CVE-2026-13352 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-13352

Vulnerability Analysis

The vulnerability resides in the allowed_mime_types function within the ProfilePress Digital Products module. The plugin registers an upload_mimes filter globally during initialization in src/Membership/DigitalProducts/Init.php. This filter adds executable file extensions to the WordPress MIME allowlist that governs which file types can be uploaded through the Media Library and other upload contexts.

Because the filter is applied on every request without scoping, the expanded MIME allowlist affects all upload contexts across the site. Any authenticated user with the upload_files capability, which by default includes the Author, Editor, and Administrator roles, can upload files with the added executable extensions. Uploaded files land in the WordPress uploads directory, where they may be executed depending on server configuration.

Root Cause

The root cause is missing context scoping on a MIME allowlist filter. The upload_mimes filter should only extend allowed types when a digital-product upload is actively taking place. Instead, the filter is registered unconditionally at plugin load, permanently adding .exe, .apk, and .msi to the global WordPress upload allowlist for the lifetime of every request.

Attack Vector

An attacker authenticates to WordPress as an Author or higher-privileged user. The attacker then uses the standard Media Library upload endpoint or the async-upload.php handler to upload a malicious file with an allowed executable extension. If the web server executes the uploaded content, or if the file is later delivered to victims, the attacker can achieve remote code execution or malware distribution. The Wordfence advisory documents the vulnerable code paths in UploadHandler.php at lines 18 and 49. See the Wordfence Vulnerability Report and the ProfilePress source code for technical details.

Detection Methods for CVE-2026-13352

Indicators of Compromise

Files with .exe, .apk, or .msi extensions inside the wp-content/uploads/ directory tree
Unexpected entries in wp_posts with post_mime_type values matching executable MIME types such as application/x-msdownload or application/vnd.android.package-archive
Access log entries showing POSTs to wp-admin/async-upload.php or wp-admin/media-new.php from author-level accounts followed by requests to newly created upload paths

Detection Strategies

Audit installed WordPress plugins for wp-user-avatar or ProfilePress at or below version 4.16.18
Scan the uploads directory for executable file signatures and hash suspicious binaries against threat intelligence feeds
Review WordPress user accounts with author or higher roles for recent creation, permission changes, or anomalous upload activity

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and alert on creation of files with executable extensions
Forward WordPress and web server access logs to a centralized log platform and alert on uploads that produce executable MIME types
Correlate authentication events with subsequent upload activity to identify compromised author-level accounts

How to Mitigate CVE-2026-13352

Immediate Actions Required

Update the ProfilePress plugin to a version later than 4.16.18 that removes the unconditional upload_mimes filter
Audit all author-level and higher WordPress accounts, rotate credentials, and enforce multi-factor authentication
Remove any unexpected .exe, .apk, or .msi files from the uploads directory and investigate their origin

Patch Information

The vendor addressed the issue in a subsequent release. Review the WordPress plugin changeset for the corrective changes to Init.php and UploadHandler.php. Confirm the installed version reports higher than 4.16.18 after the update.

Workarounds

Restrict the upload_files capability for the Author role using a role editor plugin or custom code until the plugin is patched
Add a server-level rule in Apache or Nginx to deny execution of .exe, .apk, .msi, and other non-media file types within wp-content/uploads/
Deploy a web application firewall rule to block requests to async-upload.php containing executable MIME types or extensions

bash

# Nginx configuration example to block executable delivery from uploads
location ~* ^/wp-content/uploads/.*\.(exe|apk|msi|php|phtml)$ {
    deny all;
    return 403;
}