Critical severity9.8NVD Advisory· Published Jul 7, 2021· Updated Jun 17, 2026

CVE-2021-34623

Description

A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .

Affected products

WordPress/Profilepressllm-fuzzy
Range: 3.0.0 - 3.1.3
Package: https://wordpress.org/plugins/profilepress
ProfilePress/ProfilePressv5
Range: 3.0.0 - 3.1.3

Patches

Vulnerability mechanics

References

www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000