UsersWP < 1.2.54 - Cross-Site Request Forgery

Description

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.53. This is due to missing or incorrect nonce validation on the ajax_avatar_banner_upload() function. This makes it possible for unauthenticated attackers to upload banners for other users granted they can trick an authenticated site user into performing an action such as clicking on a link.