UsersWP < 1.2.3.1 – Subscriber+ User Avatar Override | CVE 2022-0442 | Plugin Vulnerabilities

Description

The plugin is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.

Proof of Concept

- Right click the thumbnail of another user and copy the image URL. It will be something like: wp-content/uploads/2022/02/myprofilepic_uwp_avatar_thumb.png.
- Create a local file called myprofilepic.png, and upload it as your new profile photo.
- Go check the other user again, and it should now have your profile photo.

More details:
https://youtu.be/OHnpCjdAvgg

Affects Plugins

Fixed in 1.2.3.1

References

CVE

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Felipe de Avila

Submitter

Felipe de Avila

Submitter twitter

Verified

Yes

WPVDB ID

9cf0822a-c9d6-4ebc-b905-95b143d1a692

Timeline

Publicly Published

2022-02-14 (about 3 years ago)

Added

2022-02-14 (about 3 years ago)

Last Updated

2022-04-08 (about 3 years ago)

Other

Published

Title

Published

2024-08-12

Title

WP Job Portal < 2.1.9 - Subscriber+ Insecure Direct Object Reference

Published

2024-08-26

Title

Timetics < 1.0.24 - Authorization Bypass

Published

2025-10-31

Title

Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password

Published

2024-11-21

Title

Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure

Published

2023-11-23

Title

Accept Stripe Payments < 2.0.80 - Insecure Direct Object Reference