CVE-2026-13352

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowedmimetypes function. This is due to the unconditional...

CVE-2026-13352

The ProfilePress/ Paid Membership plugin for WordPress (up to version 4.16.18) is vulnerable to Arbitrary File Upload via the allowed_mime_types/upload_mimes filter expansion. A filter is registered globally on every request, unconditionally adding executable extensions (.exe, .apk, .msi) to the ...