WordPress security by component
User Profile Picture
Plugin description
User Profile Picture allows users to set and display profile pictures in WordPress.
User Profile Picture (user-profile-picture) is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Aug 02, 2021; the highest published CVSS base score is 7.5.
Plugin slug:
user-profile-pictureLatest vulnerability
CVE-2021-24473: User Profile Picture: Broken access control
User Profile Picture is affected by broken access control. Exposure depends on how the affected operation is made reachable by the site. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.
| Safe version |
|
||
|---|---|---|---|
| Aug 02, 2021 |
CVE-2021-24473
User Profile Picture: Broken access control
User Profile Picture is affected by broken access control. Exposure depends on how the affected operation is made reachable by the site. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.
|
See mitigation notes |
CVEPending
NVD5.4
|
| Apr 05, 2021 |
CVE-2021-24170
REST API endpoint get_users in the User Profile Picture: A security weakness
REST API endpoint get_users in the User Profile Picture is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVEPending
NVD7.5
|