CVE-2026-13352— WordPress ProfilePress 任意文件上传漏洞

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_mime_types function. This is due to the unconditional registration of an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the global WordPress MIME allowlist, without scoping the expansion to digital-product upload contexts. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible. This filter is registered globally on every request regardless of whether the digital products feature is configured or in use, meaning the expanded MIME allowlist affects all WordPress upload contexts site-wide.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

危险类型文件的不加限制上传

WordPress ProfilePress 任意文件上传漏洞

properfraction profilepress是properfraction个人开发者的一款用户个人资料管理插件。 WordPress ProfilePress 4.16.18及之前版本存在任意文件上传漏洞，该漏洞源于allowed_mime_types函数无条件注册upload_mimes过滤器，将可执行文件扩展名（.exe、.apk、.msi）添加到全局MIME允许列表，而未将其限制在数字产品上传环境中，导致经身份验证的攻击者（需作者级及以上权限）上传可执行文件，可能实现远程代码执行。

N/A

N/A