CVE-2021-24473 User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR

2021-08-0210:32:14

CWE-639

WPScan

www.cve.org

wordpress

plugin

idor

arbitrary change

security issue

EPSS

0.001

Percentile

30.5%

JSON

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).

CNA Affected

[
  {
    "product": "User Profile Picture",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.6.0",
        "status": "affected",
        "version": "2.6.0",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/79982ea9-4733-4b1e-a43e-17629c1136de

EPSS

0.001

Percentile

30.5%

JSON

Related for CVELIST:CVE-2021-24473