Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Limited File Upload via Non-File Custom Fields
- ID
- WPSEC-2026-0399
- Plugin
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (wp-user-avatar)
- Affected
- from 3.0 before 4.17.6
- Remediation
- Update to 4.17.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-434
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface
- Fix released
- Published
Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to limited file uploads in all versions up to, and including, 4.17.5. This is due to the file uploader accepting uploads for any custom field key, including the billing field keys that are always defined, rather than only for file-type fields, and keeping the files of registrations that fail. This makes it possible for unauthenticated attackers to store files in a public uploads folder through the registration and membership checkout forms, even where no file field is offered. Uploads are limited to the file types WordPress allows for unauthenticated users.
References
- https://wpsec.com/vuln/WPSEC-2026-0399/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.17.6/
- https://wordpress.org/plugins/wp-user-avatar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS