CVE-2026-13352
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The ProfilePress plugin for WordPress up to version 4.16.18 is vulnerable to arbitrary file upload. The allowed_mime_types function globally adds executable extensions (.exe, .apk, .msi) to the MIME allowlist without scoping to digital product contexts. This allows authenticated attackers with author-level access or above to upload executable files, leading to remote code execution.
Risk Assessment
The organization is at risk of remote code execution by authenticated users with author-level or higher privileges. Attackers can upload malicious executable files, potentially leading to full server compromise.
Recommendation
Immediately update the ProfilePress plugin to the latest available version. If an update is not possible, temporarily disable the plugin or restrict user permissions below author level.
Other vulnerabilities in ProfilePress
See all- CVE-2026-19848Medium
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.
- CVE-2026-18385Medium
The ProfilePress plugin for WordPress up to version 4.16.19 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode. Authenticated attackers with subscriber-level access can execute arbitrary shortcodes, and partial mitigations can be bypassed via various render paths.
- CVE-2026-41556Medium
There is a Cross Site Scripting (XSS) vulnerability in ProfilePress versions <= 4.16.13 related to subscribers.
- CVE-2026-3309Medium
The ProfilePress plugin for WordPress up to version 4.16.11 allows arbitrary shortcode execution. This is because billing field values from the checkout process are interpolated into shortcode template strings without proper sanitization. Unauthenticated attackers can execute arbitrary shortcodes by submitting crafted billing field values during checkout.
- CVE-2026-3445High
The ProfilePress plugin for WordPress up to version 4.16.11 has a vulnerability allowing unauthorized membership payment bypass. Missing ownership verification on the change_plan_sub_id parameter in process_checkout() allows authenticated attackers (subscriber level and above) to reference another user's active subscription, manipulate proration calculations, and obtain paid lifetime membership plans without payment.
Original NVD description (English source)
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_mime_types function. This is due to the unconditional registration of an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the global WordPress MIME allowlist, without scoping the expansion to digital-product upload contexts. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible. This filter is registered globally on every request regardless of whether the digital products feature is configured or in use, meaning the expanded MIME allowlist affects all WordPress upload contexts site-wide.