CVE-2021-24675CWE-352

One User Avatar < 2.3.7 - Avatar Update via CSRF

published October 18, 2021

CVSS
—
EPSS
1%
Percentile
46.5
In the wild
Unconfirmed
What it is

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00572 · 46.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-10-18T13:45Z
EPSS history
Timeline
  • 18 OCT 13:45Z
    One User Avatar < 2.3.7 - Avatar Update via CSRF
    cvelistv5