User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR
CVE-2021-24473

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
User Profile Picture
Vendor
CVE Published:
2 August 2021

What is CVE-2021-24473?

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).

Affected Version(s)

User Profile Picture 2.6.0

References

https://wpscan.com/vulnerability/79982ea9-4733-4b1e-a43e-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

apple502j
.
CVE-2021-24473 : User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR