ProfilePress < 4.16.19 - Author+ Limited Unsafe File Upload via upload_mimes Filter Expansion

Description

The plugin is vulnerable to arbitrary file upload due to the allowed_mime_types function unconditionally registering an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the global WordPress MIME allowlist, without scoping the expansion to digital-product upload contexts. Because the filter is registered on every request regardless of whether the digital products feature is configured or in use, the expanded allowlist affects all upload contexts site-wide, making it possible for authenticated attackers with Author-level access and above to upload potentially unsafe file types. These extensions are not executable by the web server, so the impact is limited to hosting unexpected/unsafe files on the site rather than direct remote code execution.