PT-2021-15716 · WordPress · User Profile Picture

Chloe Chamberland · Published 2021-04-05 · Updated 2025-09-18 · CVE-2021-24170

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: User Profile Picture WordPress plugin versions prior to 2.5.0

Description: The issue concerns the REST API endpoint "get users" in the User Profile Picture WordPress plugin, which returned excessive information to users with the upload files capability. This included sensitive data such as password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.

Recommendations: For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "get users" API endpoint to minimize the risk of exploitation. Avoid using the upload files capability for users who do not require it until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-24170

Affected Products

User Profile Picture

References · 5

• 🔥 https://wpscan.com/vulnerability/29fc5b0e-0a5f-4484-a1e6-a0a1206726cc · Exploit
• https://osv.dev/vulnerability/CVE-2021-24170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24170 · Security Note
• https://wordfence.com/blog/2021/03/medium-severity-vulnerability-patched-in-user-profile-picture-plugin · Note
• https://twitter.com/pdnuclei_bot/status/1968646229837205991 · Twitter Post