Description

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-31T15:17:37.503Z",
  "pubdate": "2026-08-31T15:17:37.503Z",
  "executiveSummary": "The ProfilePress (wp-user-avatar) WordPress plugin, in versions prior to 4.17.2, is susceptible to an unauthenticated Remote Code Execution (RCE) vulnerability. This flaw stems from a critical weakness in the ppress_connect_process AJAX handler, which utilizes an insufficiently secure 32-bit token for authentication.\nBy brute-forcing this weak token, an unauthenticated remote attacker can successfully invoke internal plugin installation and activation processes. This allows for the arbitrary deployment of malicious code on the target server. The impact of this vulnerability is severe, as it facilitates complete unauthorized control over the server environment by executing arbitrary PHP code as the web-server user. Due to the lack of authentication requirements and the remote nature of the exploit, this vulnerability poses a high risk to the availability, integrity, and confidentiality of affected WordPress installations.",
  "technicalDetails": "The vulnerability resides within the ppress_connect_process AJAX handler, which was designed to facilitate plugin connectivity and remote operations. The root cause of the vulnerability is the implementation of a 32-bit token to secure the connection process, which is cryptographically insufficient against brute-force attacks.\nThe attack flow commences when an unauthenticated actor targets the ppress_connect_process endpoint. Since the security mechanism relies on a 32-bit value, the search space for the valid token is limited, allowing an attacker to iterate through potential combinations within a reasonable timeframe. Once the token is successfully brute-forced, the attacker gains the ability to interact with the handler's internal logic, specifically the functionality designated for plugin management.\nThe handler accepts a file parameter, which functions as the source URL for plugin acquisition. By supplying a URL to a malicious zip archive containing arbitrary PHP code, the attacker forces the system to download, extract, and activate the payload via the plugin installation architecture. Because the WordPress environment automatically executes the plugin's main entry file upon activation, the attacker achieves immediate Remote Code Execution.\nThe exploit runs under the context of the web-server user, granting the attacker the same system permissions as the application server. This bypasses all standard administrative authentication gates, as the attacker leverages the trust established by the improperly implemented token to invoke administrative-level installation routines. Post-exploitation impact typically involves the establishment of persistent backdoors, data exfiltration, or complete system compromise, depending on the capabilities of the uploaded PHP payload."
}