WordPress Plugin Vulnerabilities
UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override
Description
The plugin is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
Proof of Concept
- Right click the thumbnail of another user and copy the image URL. It will be something like: wp-content/uploads/2022/02/myprofilepic_uwp_avatar_thumb.png. - Create a local file called myprofilepic.png, and upload it as your new profile photo. - Go check the other user again, and it should now have your profile photo. More details: https://youtu.be/OHnpCjdAvgg
Affects Plugins
Fixed in version 1.2.3.1
References
Classification
Miscellaneous
Original Researcher
Felipe de Avila
Submitter
Felipe de Avila
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-02-14 (about 4 months ago)
Added
2022-02-14 (about 4 months ago)
Last Updated
2022-04-08 (about 3 months ago)