1. Home
  2. CVE Database
  3. CVE-2021-24473
MEDIUM · 5.4

CVE-2021-24473

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pic...

Vulnerability Description

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
CozmoslabsUser Profile Picture< 2.6.0

Related Weaknesses (CWE)

CWE-639

References

FAQ

What is CVE-2021-24473?

CVE-2021-24473 is a vulnerability with a CVSS score of 5.4 (MEDIUM). The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pic...

How severe is CVE-2021-24473?

CVE-2021-24473 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24473?

Check the references section above for vendor advisories and patch information. Affected products include: Cozmoslabs User Profile Picture.