ProfilePress vulnerability: is your WooCommerce store affected?

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

1. Data exposure

   Information meant to stay private could be read.

   Score 8.8 (high)needs only a customer accountAffected: older than 4.17.5Fixed in 4.17.5Published 2 October 2026CVE-2026-92536

   Advisory: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,...

2. Code execution

   Someone could run their own code on your server.

   Score 8.1 (high)no login neededAffected: older than 4.17.2Fixed in 4.17.2Published 31 August 2026CVE-2026-66047

   Advisory: ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by...

3. Missing permission check

   An action that should need permission could be done without it.

   Score 8.1 (high)needs only a customer accountAffected: older than 4.17.3Fixed in 4.17.3Published 31 August 2026CVE-2026-85658

   Advisory: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and...

4. File upload

   Someone could upload files to your server, which can include code.

   Score 8.8 (high)needs only a customer accountAffected: older than 4.16.19Fixed in 4.16.19Published 16 July 2026CVE-2026-13352

   Advisory: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and...

5. Data exposure

   Information meant to stay private could be read.

   Score 7.5 (high)no login neededAffected: older than 4.13.3Fixed in 4.13.3Published 2 October 2023CVE-2023-44150

   Advisory: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content –...

6. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 8.6 (high)no login neededAffected: older than 4.13.2Fixed in 4.13.2Published 9 September 2023CVE-2023-41954

   Advisory: Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1.

7. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.1 (high)no login neededAffected: older than 4.5.5Fixed in 4.5.5Published 21 February 2023ce078430e6d41329fc52e5a6699025103302494f

   Advisory: The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via numerous parameters in versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping.

8. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.1 (high)no login neededAffected: older than 4.5.5Fixed in 4.5.5Published 27 January 2023a53d0ad2a4d425946e6aa77e58186c6355bb27b8

   Advisory: The ProfilePress plugin for WordPress is vulnerable to Cross-Site Scripting via $data['name'] parameter in versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping.

How to check your version

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find ProfilePress. The version number is under its name. If it is lower than 4.17.5, your store is affected.
3. No login to hand? Open https://yourstore.com/wp-content/plugins/wp-user-avatar/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
2. On the copy, update ProfilePress to 4.17.5 or newer: Dashboard > Updates, or Update now on the Plugins page.
3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use ProfilePress.
5. If everything works, make the same update on the live store and place one more test order.
6. If you no longer use ProfilePress, delete it instead of leaving it deactivated.

Questions

Which ProfilePress version fixes it?

Version 4.17.5 or newer fixes all 8 issues on this page.

How do I know if my store is affected?

Your store is affected if it runs ProfilePress older than 4.17.5. In WordPress, open Plugins and read the version under ProfilePress. Without logging in, open yourstore.com/wp-content/plugins/wp-user-avatar/readme.txt and read the Stable tag line.

I don't use ProfilePress any more. Is a deactivated copy safe?

Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.

Can someone fix it for me?

Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.