CVE-2021-34622: Privilege Escalation in ProfilePress

The impact of CVE-2021-34622 is severe. Successful exploitation allows an attacker to gain administrator-level access to the WordPress site without authentication. This grants them the ability to modify any content, install malicious plugins or themes, steal sensitive data (user credentials, financial information, customer data), and potentially deface the website. The attacker could also use the compromised site as a launchpad for further attacks against other systems on the network, expanding the blast radius significantly. This vulnerability shares similarities with other WordPress privilege escalation flaws where user profile manipulation is exploited to gain unauthorized access.

1. Reserved2021-06-10
2. Published2021-07-07
3. Modified2024-10-15
4. EPSS updated2026-04-02

The primary mitigation for CVE-2021-34622 is to immediately upgrade ProfilePress to a patched version. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting user profile editing capabilities. Implement a Web Application Firewall (WAF) rule to block suspicious requests targeting the /wp-admin/profile.php endpoint with unusual parameters. Monitor WordPress logs for any unauthorized profile modification attempts. Specifically, look for unusual user agent strings or IP addresses accessing profile editing functions. After upgrading, verify the fix by attempting to create a new user account and confirming that it does not automatically gain administrator privileges.