PT-2021-15997 · WordPress · User Profile Picture

Apple502J · Published 2021-08-02 · Updated 2021-09-20 · CVE-2021-24473

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions User Profile Picture WordPress plugin versions prior to 2.6.0

Description The issue allows users with the upload image capability to change and delete the profile pictures of other users, including those with higher roles.

Recommendations For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-24473

Affected Products

User Profile Picture

References · 3

• 🔥 https://wpscan.com/vulnerability/79982ea9-4733-4b1e-a43e-17629c1136de · Exploit
• https://osv.dev/vulnerability/CVE-2021-24473 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24473 · Security Note