CVE-2026-66047: Missing Authentication for Critical Function in Proper Fraction ProfilePress

CVE-2026-66047 affects the ProfilePress WordPress plugin (also known as wp-user-avatar) in versions prior to 4.17.2. The vulnerability arises from missing authentication on a critical function accessed through the ppress_connect_process AJAX handler. An attacker can brute-force a weak 32-bit connect token to bypass authentication and supply a caller-controlled URL via the file request parameter. This enables silent installation and activation of arbitrary plugins, resulting in remote code execution with the privileges of the web-server user.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the affected server by installing and activating arbitrary plugins. This can lead to full compromise of the WordPress site and potentially the underlying server environment. The CVSS 4.0 base score is 9.2, indicating critical severity with network attack vector, no privileges required, and no user interaction needed.

Upgrade ProfilePress to version 4.17.2 or later, where this vulnerability is fixed. Patch status is confirmed by the affectedVersions field indicating versions before 4.17.2 are vulnerable. No vendor advisory content was provided, so check the official ProfilePress plugin release notes or vendor advisory for confirmation and additional guidance.