Non notée
CVE-2021-24675 The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the…
Description
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| One User Avatar | User Profile Picture 2.3 | premières → < 2.3.7 | 2.3.7 |