CVE-2026-96337 Overview
CVE-2026-96337 is a Missing Authorization vulnerability [CWE-862] in the ProfilePress plugin (wp-user-avatar) by properfraction for WordPress. The flaw stems from incorrectly configured access control security levels, allowing authenticated users with low privileges to perform actions reserved for higher-privileged roles. The issue affects all ProfilePress versions up to and including 4.17.3. An attacker can exploit this flaw over the network with no user interaction, impacting the integrity of the WordPress site.
Critical Impact
Authenticated attackers with minimal privileges can bypass access controls in ProfilePress through version 4.17.3, modifying data or configurations outside their authorized scope on affected WordPress installations.
Affected Products
- ProfilePress (wp-user-avatar) WordPress plugin by properfraction
- All versions from n/a through 4.17.3
- WordPress sites with the vulnerable plugin installed and activated
Discovery Timeline
- 2026-10-09 - CVE-2026-96337 published to NVD
- 2026-10-09 - Last updated in NVD database
Technical Details for CVE-2026-96337
Vulnerability Analysis
The vulnerability resides in the ProfilePress plugin's access control implementation. ProfilePress exposes functionality that lacks proper capability or authorization checks before executing privileged operations. An authenticated user holding low-level credentials, such as a subscriber account, can invoke affected endpoints and perform actions intended for administrators or site managers.
The flaw affects integrity but does not expose confidential data or disrupt availability. Successful exploitation lets attackers alter plugin settings, user profile data, or related state managed by ProfilePress.
Root Cause
The root cause is a Missing Authorization weakness [CWE-862]. ProfilePress registers handlers that execute sensitive operations but fail to validate whether the requesting user holds the required WordPress capability. Nonce verification alone does not substitute for a current_user_can() capability check. The security level enforced on affected endpoints is lower than the sensitivity of the actions those endpoints perform.
Attack Vector
An attacker requires an authenticated account on the target WordPress site, which can often be obtained through open registration on sites that use ProfilePress for front-end user management. After authenticating, the attacker sends crafted HTTP requests to the vulnerable plugin endpoints over the network. The requests invoke privileged actions that the plugin executes without verifying the caller's role or capability. No user interaction and no social engineering are required.
No verified public proof-of-concept code is available at the time of publication. Technical details are documented in the Patchstack Security Vulnerability Report.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-96337
Indicators of Compromise
- Unexpected changes to ProfilePress plugin settings, user roles, or profile fields without a corresponding administrator action.
- Requests to wp-admin/admin-ajax.php or ProfilePress-specific endpoints originating from accounts with the subscriber or similar low-privilege role.
- New or modified user accounts whose creation cannot be tied to a legitimate administrative session.
Detection Strategies
- Audit WordPress access logs for POST requests from low-privilege sessions to ProfilePress action handlers.
- Correlate authenticated user IDs with the WordPress capability required for each requested action; flag mismatches.
- Deploy a web application firewall rule that inspects ProfilePress AJAX actions and verifies the requesting role against an allow list.
Monitoring Recommendations
- Enable WordPress audit logging for role changes, option updates, and plugin setting modifications.
- Monitor the installed ProfilePress version across all WordPress sites and alert when the version is 4.17.3 or earlier.
- Track EPSS trend data for CVE-2026-96337, currently reported at a probability of 0.174% on 2026-10-16, and reassess exposure if the score rises.
How to Mitigate CVE-2026-96337
Immediate Actions Required
- Identify all WordPress sites running ProfilePress (wp-user-avatar) and determine their installed version.
- Update ProfilePress to a release later than 4.17.3 once the vendor publishes a patched version.
- Restrict new user registration on sites that do not require public sign-up to reduce the pool of accounts that could exploit the flaw.
- Review recent administrative changes and ProfilePress-related log entries for signs of unauthorized actions.
Patch Information
The vulnerability affects ProfilePress from an unspecified initial version through 4.17.3. Administrators should consult the Patchstack Security Vulnerability Report and the plugin's WordPress.org listing for the fixed release and apply it across all affected sites.
Workarounds
- Deactivate the ProfilePress plugin until a patched version is installed if the plugin is not business-critical.
- Deploy a WordPress-aware web application firewall with virtual patching rules that block unauthorized calls to ProfilePress action handlers.
- Enforce least-privilege role assignments and disable self-registration on sites where ProfilePress is active.
# Configuration example: disable open registration via wp-config.php
# and verify the installed ProfilePress version via WP-CLI
wp option update users_can_register 0
wp plugin get wp-user-avatar --field=version
wp plugin update wp-user-avatar
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
