CVE-2026-66047: ProfilePress WordPress Plugin RCE Vulnerability

CVE-2026-66047 Overview

CVE-2026-66047 is an unauthenticated remote code execution vulnerability in the ProfilePress (wp-user-avatar) WordPress plugin before version 4.17.2. The flaw resides in the ppress_connect_process AJAX handler, which validates requests using a weak 32-bit connect token that attackers can brute-force. Once the token is guessed, an attacker supplies a caller-controlled URL through the file request parameter to trigger silent installation and activation of an arbitrary plugin. This yields PHP code execution as the web-server user on the target WordPress instance. The weakness is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated attackers can achieve full remote code execution on affected WordPress sites, leading to complete site takeover and lateral movement into hosting infrastructure.

Affected Products

ProfilePress (wp-user-avatar) WordPress plugin versions before 4.17.2
WordPress installations with the vulnerable plugin installed and active
Any hosting environment exposing the vulnerable admin-ajax.php endpoint to the internet

Discovery Timeline

2026-08-31 - CVE-2026-66047 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-66047

Vulnerability Analysis

The vulnerability originates in the ppress_connect_process AJAX action exposed by the ProfilePress plugin through WordPress's admin-ajax.php endpoint. The handler authorizes callers based solely on a connect token generated from a 32-bit keyspace. This entropy is insufficient to resist brute-force enumeration over the network. Once a valid token is discovered, the handler treats the request as trusted and executes privileged plugin management logic without additional authentication or capability checks.

After passing the weak token gate, the handler accepts a file parameter that specifies a remote URL. The plugin fetches the referenced archive, installs it as a WordPress plugin, and activates it silently. Because activated plugins execute PHP under the web-server user, attackers gain arbitrary code execution on the host. See the VulnCheck Advisory for the detailed technical breakdown.

Root Cause

The root cause is missing authentication combined with a low-entropy access token. The handler substitutes token possession for user authentication and capability verification. A 32-bit token space is tractable to brute-force at network speed, effectively collapsing the authentication boundary. WordPress capability checks such as install_plugins and activate_plugins are not enforced on the code path reached after token validation.

Attack Vector

An unauthenticated attacker sends repeated POST requests to admin-ajax.php with action=ppress_connect_process and iterates values of the connect token parameter. After a successful token guess, the attacker submits a follow-up request supplying a file parameter that references an attacker-hosted ZIP archive containing a malicious WordPress plugin. The plugin is downloaded, installed, and activated by the vulnerable code path. The activated plugin's PHP payload executes on the next request cycle, delivering webshell access, credential theft, or persistence on the WordPress host.

Detection Methods for CVE-2026-66047

Indicators of Compromise

High-volume POST requests to /wp-admin/admin-ajax.php containing action=ppress_connect_process from a single or distributed source IP set
Outbound HTTP requests from the WordPress server fetching ZIP archives from unfamiliar external domains shortly after token brute-force activity
New plugin directories under wp-content/plugins/ with recent creation timestamps that do not correspond to administrator activity
PHP files under wp-content/plugins/ containing obfuscated eval, base64_decode, or assert calls

Detection Strategies

Alert on more than a threshold of ppress_connect_process AJAX requests per source IP within a short interval to catch token brute-force attempts
Monitor WordPress options and active_plugins database entries for unexpected additions
Correlate web-server access logs with file-integrity monitoring events under wp-content/plugins/

Monitoring Recommendations

Enable verbose logging on admin-ajax.php including request bodies to retain evidence of token enumeration
Forward WordPress and web-server logs to a centralized analytics platform for retention and search
Track process creation on the web-server host for php spawning shell utilities such as sh, bash, curl, or wget

How to Mitigate CVE-2026-66047

Immediate Actions Required

Upgrade ProfilePress (wp-user-avatar) to version 4.17.2 or later on every WordPress instance
Audit wp-content/plugins/ for unfamiliar plugin directories and remove any that cannot be attributed to an administrator action
Rotate WordPress administrator credentials, API keys, and secrets stored in wp-config.php if compromise is suspected
Review the ProfilePress Changelog to confirm the fixed release is deployed

Patch Information

The vendor released ProfilePress 4.17.2, which remediates the weak-token authentication path in ppress_connect_process. Site operators should update through the WordPress plugin manager or replace the plugin directory with the fixed release from the WP User Avatar Plugin page. Confirm the installed version in the WordPress admin dashboard after deployment.

Workarounds

Temporarily deactivate the ProfilePress plugin until the update to 4.17.2 is applied
Block requests to admin-ajax.php with action=ppress_connect_process at the web application firewall until patching completes
Restrict outbound HTTP egress from the WordPress host so remote plugin archives cannot be fetched from attacker-controlled URLs

bash

# Example WAF rule fragment to block the vulnerable AJAX action
# ModSecurity syntax
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026066047,msg:'Block ProfilePress ppress_connect_process (CVE-2026-66047)'"
  SecRule ARGS:action "@streq ppress_connect_process"