Executive brief
ProfilePress is a WordPress membership and ecommerce plugin used to manage user registration, payments, and content access control. An unauthenticated attacker can brute-force a weak security token to install and activate arbitrary plugins without permission, leading to complete server compromise and malicious code execution with the privileges of the web server.
Technical details
The vulnerability is a remote code execution flaw in the ppress_connect_process AJAX handler that uses a weak 32-bit token for authentication. Attackers can brute-force this token to bypass authentication and invoke the handler from the network without any credentials or user interaction. Once authenticated, the attacker can supply a malicious plugin URL via the file parameter to trigger silent, unauthorized plugin installation and activation. This results in arbitrary PHP code execution running as the web-server user. The vulnerability affects versions before 4.17.2; patched versions implement stronger token generation and validation.
Affected products
- properfraction ProfilePress before 4.17.2
Timeline
- 2026-08-31: disclosed
- 2026: patched: Fixed in version 4.17.2