WP User Avatars <= 1.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Assignment via assign_wp_user_avatars_media AJAX Action
- ID
- WPSEC-2026-0120
- Plugin
- WP User Avatars (wp-user-avatars)
- Affected
- all versions before 2.0.0
- Remediation
- Update to 2.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP User Avatars on WPSec AttackSurface
- Fix released
- Published
Description
The WP User Avatars plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.1 via the assign_wp_user_avatars_media AJAX action due to missing validation on a user controlled key. The handler only checked that the current user could edit the target profile, which every user can do for their own, and did not check that they could access the Media Library or the supplied attachment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set any image attachment on the site, including images attached to private or draft posts, as their own avatar and obtain its URL (and a resized copy) from the returned avatar markup.
References
- https://wpsec.com/vuln/WPSEC-2026-0120/
- https://plugins.svn.wordpress.org/wp-user-avatars/tags/2.0.0/
- https://wordpress.org/plugins/wp-user-avatars/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS