WordPress security changelog
HIGH CVE-2026-18983 Deferred

One User Avatar accepts potentially executable Subscriber uploads

One User Avatar through 2.5.4 calls wp_handle_upload() without a MIME allow-list and relies on the client-supplied Content-Type after writing the file, without cleaning rejected files. When an administrator has enabled Subscriber avatar uploads, a Subscriber can upload a potentially executable DXFP file and make remote code execution possible; PHP and SVG files are rejected.

CVE / CNA score 7.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
One User Avatar | User Profile Picture
Plugin slug
one-user-avatar
Affected
<= 2.5.4
Safe version
See mitigation notes
Published
Aug 28, 2026
Weakness
CWE-434 — Unrestricted Upload of File with Dangerous Type

This CVE was published Aug 28, 2026 and is one of 3 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed release is confirmed. Update One User Avatar when a release after 2.5.4 is confirmed to fix the issue; until then, disable low-privilege avatar uploads and inspect upload directories for unexpected executable files.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() called without a MIME allow-list, with post-write validation relying on the attacker-controlled client-supplied Content-Type header rather than a server-derived type, and no cleanup of files that fail the check. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. in order to exploit this vulnerability an admin has to give subscribers permission to upload avatars. While PHP files and svg files are rejected, dxfp files are accepted.

CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources