External risk intelligence

ProfilePress Plugin Unauthenticated Arbitrary Plugin Installation RCE.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-66047

The vulnerability exists in a WordPress plugin that handles AJAX requests from the public internet. As a component of a web-facing application, the plugin's endpoints are exposed by design to accommodate site functionality, making this surface reachable to any unauthenticated user visiting the website.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in a popular WordPress plugin allows unauthenticated attackers to install and activate any plugin by exploiting a weak token. This could enable attackers to execute arbitrary code on your systems through a technical method involving a brute-forced token and a controlled URL. The main concern is confirming relevance and exposure of this plugin.

Allows unauthenticated plugin installation and code execution.
Enables arbitrary plugin installation on websites.
Confirm plugin relevance and any exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by interacting with a public website that uses a vulnerable version of the ProfilePress WordPress plugin. By repeatedly sending requests to a specific AJAX handler and guessing a short token, an attacker can trick the plugin into installing and activating any other plugin. This can lead to the attacker executing arbitrary code on the web server.

No authentication required.
Guessing a weak token in AJAX handler.
Allows arbitrary plugin installation and RCE.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the web server. This could occur when the plugin is used and an attacker is able to guess or discover a weak "connect token" to trigger the installation and activation of a malicious plugin. The primary risk is the compromise of the web server's environment, as the attacker can execute commands with the privileges of the web server user.

Web server code execution.
Attacker forces weak token for installation.
Server compromise, potentially affecting site data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determine responsibility by considering which teams manage WordPress deployments and plugin lifecycles. The first practical step involves locating all instances of the affected plugin, assessing their exposure and business criticality, identifying the designated owner, and then prioritizing remediation efforts.

Plugin owners should investigate.
Verify reachability and criticality.
Plan coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ProfilePress plugin?

ProfilePress, also known as wp-user-avatar, is a WordPress plugin used to manage user registration, login, and profile customization. It provides interactive forms and account management features directly on a website, which often requires the plugin to handle incoming web traffic to process user actions and maintain site functionality.

What does CWE-306 and CWE-330 mean for CVE-2026-66047?

These codes describe the root cause of the vulnerability. CWE-306 (Missing Authentication for Critical Function) means a vital action can be performed without verifying who the user is. CWE-330 (Use of Insufficiently Random Values) refers to the weak 32-bit connect token. Together, they allow an attacker to bypass security checks by guessing a predictable token, tricking the system into performing unauthorized administrative tasks like installing plugins.

How does an attacker trigger this vulnerability?

An attacker targets the ppress_connect_process AJAX handler. By brute-forcing the weak 32-bit token, they gain access to the installation function. They then provide a URL to a chosen plugin, which the server downloads and activates. This process does not trigger if the token is strong or if the specific AJAX handler is disabled or restricted from accepting external requests.

Is my website at risk if it uses ProfilePress?

According to Halo Surface Signal, this vulnerability is highly relevant because the plugin is designed to handle AJAX requests from the public internet. Since these endpoints are exposed by design to support site features, any website running an affected version is reachable by unauthenticated users, making the risk of exploitation a primary concern for site administrators.

What are the first steps to secure my site?

Begin by identifying all WordPress sites in your environment running the ProfilePress plugin. Determine which versions are installed to see if they fall below 4.17.2. Once you have a list, coordinate with the teams managing those specific web deployments to prioritize updating the plugin to a secure version, which eliminates the flaw by strengthening the token handling.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.