Skip to content
Sign in
4.3 Medium

CVE-2024-5639 The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,…

Description

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update the profile picture of any user.

Affected products and versions

Product Affected versions Fixed in
User Profile Picture 2.6 earliest → 2.6.1 No fix stated

Other CVEs of User Profile Picture

The 2 CVEs of User Profile Picture →
CVE-2026-61971 Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture… 2.7 Low
Track this CVE