Proper Fraction vulnerabilities and threats

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.2	EPSS 0.9%	CVE-2026-66047ProfilePress (WordPress plugin) · Missing Authentication Critical9.2EPSS 0.9%2026-08-31CVE Database V5CVE-2026-66047 ProfilePress (wp-user-avatar) WordPress plugin versions before 4.17.2 contain a critical unauthenticated remote code execution vulnerability. Attackers can brute-force a weak 32-bit connect token via the ppress_connect_process AJAX handler to install and activate arbitrary plugins silently. This leads to PHP code execution with the web-server user's privileges. EPSS 0.9%Vulnerability Proper Fraction #ghsa-7p89-vxx8-4q67	CVE Database V5	2026-08-31

Page 1 of 1