UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override

The plugin is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.

PoC

- Right click the thumbnail of another user and copy the image URL. It will be something like: wp-content/uploads/2022/02/myprofilepic_uwp_avatar_thumb.png. - Create a local file called myprofilepic.png, and upload it as your new profile photo. - Go check the other user again, and it should now have your profile photo. More details: https://youtu.be/OHnpCjdAvgg