CVE-2026-66047PoC

LOWCVSS 9.2 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306CWE-330

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Peaked 1d ago at 1 mentions (2026-09-01); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

PoC

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-01	1	PoC1
2026-09-09	1	Patch1

Full discourse2 posts

Phil_Taboada@Phil2427544337d
Patch
Si usas ProfilePress para login o membresías, actualiza a 4.17.2. Sin login podían instalar un plugin y tomar el servidor. Si estuvo expuesto, rota las claves admin. https://www.wavys-technologies.com/es/blog/profilepress-cve-2026-66047
Post summary
The advisory urges users of ProfilePress to upgrade to 4.17.2, as a vulnerability could allow unauthenticated plugin installation and server takeover; patching and resetting admin keys are recommended actions.
0000038
3 followersView on X
LoreleiWeb@LoreleiWeb46d
PoC
🆕👉 ProfilePress < 4.17.2 - Unauthenticated Arbitrary Plugin Installation RCE https://wpdeeply.com/profilepress-4-17-2-unauthenticated-arbitrary-plugin-installation-rce/ #loreleiweb A new ProfilePress vulnerability, tracked as CVE-2026-66047, affects the WordPress plugin distributed under the wp-user-avatar slug before version 4.17.2. The is… https://t.co/LOjazUXDo2
Post summary
A new CVE-2026-66047 vulnerability in ProfilePress (<4.17.2) permits unauthenticated remote code execution via arbitrary plugin installation. A public PoC is linked within the post.
00000258
85.9K followersView on X

Explore more

Back to dashboard