Aller au contenu
Se connecter
4.3 Moyenne

CVE-2024-5639 The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,…

Description

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update the profile picture of any user.

Produits et versions touchés

Produit Versions touchées Corrigé en
User Profile Picture 2.6 premières → 2.6.1 Pas de correctif indiqué

Autres CVE de User Profile Picture

Les 2 CVE de User Profile Picture →
CVE-2026-61971 Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture… 2.7 Faible
Suivre cette CVE