CVE-2021-24473CWE-639

User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR

published August 2, 2021

CVSS
—
EPSS
1%
Percentile
55.3
In the wild
Unconfirmed
What it is

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00775 · 55.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2021-08-02T10:32Z
EPSS history
Timeline
  • 02 AUG 10:32Z
    User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR
    cvelistv5