CVE-2026-66047

HighCVSS 8.1/10Last modified Sep 8, 2026

Description

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306 CWE-330

Affected software

No affected versions have been published.

Timeline

Published: Aug 31, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-66057.3A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file src CVE-2026-660507.5NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attacke CVE-2026-660535.9Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: bef CVE-2026-660546.9Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apac CVE-2026-660558.2Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. Th CVE-2026-660575.1Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled CVE-2026-660585.3Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow CVE-2026-660595.3Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType CVE-2026-66067.3A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the fi CVE-2026-660607.1Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats t CVE-2026-660617.1Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treat CVE-2026-660625.3SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation h