CVE-2021-24473
User Profile Picture < 2.6.0 - Authenticated Insecure Direct Object Reference
mediumAuthorization Bypass Through User-Controlled Key
4.3
CVSS Score
4.3
CVSS Score
medium
Severity
2.6.0
Patched in
939d
Time to patch
Description
The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NAttack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
None
Confidentiality
Low
Integrity
None
Availability
Technical Details
Affected versions
<2.6.0PublishedJune 28, 2021
Last updatedJanuary 22, 2024
Affected pluginusers-profile-picture
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.