CVE-2021-24473

🗓️ 02 Aug 2021 10:32:14Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 72 Views🌐 WEB

The User Profile Picture WordPress plugin before 2.6.0 is affected by an IDOR issue enabling users to alter and delete others' profile pictures

Reporter	Title	Published	Views	Family All 12
attackerkb	CVE-2021-24473	2 Aug 202111:15	–	attackerkb
CNNVD	WordPress 插件访问控制错误漏洞	2 Aug 202100:00	–	cnnvd
Cvelist	CVE-2021-24473 User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR	2 Aug 202110:32	–	cvelist
EUVD	EUVD-2021-11385	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24473	2 Aug 202111:15	–	nvd
OSV	CVE-2021-24473	2 Aug 202111:15	–	osv
Prion	Default credentials	2 Aug 202111:15	–	prion
Positive Technologies	PT-2021-15997	2 Aug 202100:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2021-24473: Authorization Bypass Through User-Controlled Key	2 Aug 202100:00	–	rapid7
RedhatCVE	CVE-2021-24473	22 May 202519:22	–	redhatcve

NVD

Vulners

Node

cozmoslabs user_profile_pictureRange<2.6.0wordpress

[
  {
    "product": "User Profile Picture",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.6.0",
        "status": "affected",
        "version": "2.6.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/79982ea9-4733-4b1e-a43e-17629c1136de

Parameter	Position	Path	Description	CWE
user_id	request body	/wp-admin/admin-ajax.php	IDOR vulnerability in the User Profile Picture WordPress plugin (<=2.6.0): tampering user_id in metronet_add_thumbnail to change another user's profile picture.	CWE-639
user_id	request body	/wp-admin/admin-ajax.php	IDOR vulnerability in the User Profile Picture WordPress plugin (<=2.6.0): tampering user_id in metronet_remove_thumbnail to delete another user's profile picture.	CWE-639

17 Jun 2026 03:40Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.4

CVSS 25.5

EPSS0.00775

CWE-639