PT-2025-32632 · WordPress · Simple Local Avatars

Håkon Harnes · Published 2025-08-12 · Updated 2025-08-12 · CVE-2025-8482

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Simple Local Avatars plugin for WordPress version 2.8.4

Description: The Simple Local Avatars plugin for WordPress is susceptible to unauthorized data modification due to an incomplete capability check within the migrate from wp user avatar() function. Authenticated attackers with subscriber-level access or higher can exploit this to migrate avatar metadata for all users.

Recommendations: Update to a newer version of the Simple Local Avatars plugin that addresses this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-8482

Affected Products

Simple Local Avatars

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8482 · Security Note
• https://twitter.com/CVEnew/status/1955162409523716384 · Twitter Post
• https://plugins.trac.wordpress.org/browser/simple-local-avatars/tags/2.8.4/includes/class-simple-local-avatars.php#L123 · Note
• https://t.me/CVEtracker/29759 · Telegram Post
• https://t.me/cveNotify/131779 · Telegram Post
• https://plugins.trac.wordpress.org/browser/simple-local-avatars/tags/2.8.4/includes/class-simple-local-avatars.php?marks=1663-1672#L1663 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340223%40simple-local-avatars&new=3340223%40simple-local-avatars&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/69d78334-2b38-43ee-acf6-c073d5826213?source=cve · Note