WordPress Plugin Vulnerabilities
ProfilePress < 4.17.2 - Unauthenticated Arbitrary Plugin Installation via Brute Force
Description
The plugin is vulnerable to arbitrary plugin installation, due to a brute-forceable ppress_connect_process key value. This makes it possible for unauthenticated attackers to install a malicious plugin and thereby execute arbitrary code on the server.
Affects Plugins
Fixed in 4.17.2 References
Classification
Type
RCE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Jon Bytyqi
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-08-31 (about 1 month ago)
Added
2026-09-16 (about 1 month ago)
Last Updated
2026-10-16 (about 11 hours ago)
