CVE-2026-13352

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.16.19

Description An arbitrary file upload issue exists in the allowed mime types() function. The plugin unconditionally registers an upload mimes filter that adds executable file extensions such as .exe, .apk, and .msi to the global WordPress MIME allowlist. Because this filter is registered globally on every request and not limited to digital-product upload contexts, authenticated attackers with author-level access or higher can upload executable files, potentially leading to remote code execution.

Recommendations Update to a version newer than 4.16.18.