The ProfilePress WordPress plugin, prior to version 4.17.2, contains an unauthenticated remote code execution flaw. The vulnerability resides in the ppress_connect_process AJAX handler, where attackers can brute‑force a weak 32‑bit connect token. By supplying a controlled URL through the file request parameter, an attacker can silently install and activate arbitrary plugins, thereby executing PHP code as the web‑server user. This flaw is a classic missing authentication weakness combined with insufficient verification of a cryptographic token (CWE‑306 and CWE‑330). The impact is the complete compromise of the WordPress installation, as the attacker gains the same privileges as the web server process.

Any installation of the Proper Fraction ProfilePress plugin (wp-user-avatar) running a version earlier than 4.17.2 is vulnerable. The issue is not limited to a specific platform but applies to all WordPress sites that have the plugin enabled, regardless of the underlying operating system.

The CVSS score of 9.2 indicates a critical severity. While the EPSS score is currently not available, the lack of a KEV listing does not diminish the risk; the flaw is fully exploitable without user interaction. The attack path requires only unauthenticated HTTP access to the site, allowing an attacker to trigger the vulnerable AJAX endpoint and deliver a malicious payload through a crafted URL. Given the critical score and low barriers to exploitation, administrators should consider this a high‑priority risk.