WordPress Plugin Vulnerabilities

User Profile Picture < 2.6.4 - Authenticated (Author+) Insecure Direct Object Reference

Description

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.6.3 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
metronet-profile-picture
Fixed in 2.6.4

References

CVE
CVE-2026-61971
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/50ac89bd-43fc-4b21-8d29-b320d7aa587b

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (Low)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
c505a8d7-9dd1-40a1-b7a3-2c17180f6a2d

Timeline

Publicly Published
2026-07-31 (about 2 months ago)
Added
2026-08-04 (about 2 months ago)
Last Updated
2026-08-04 (about 2 months ago)

Other

Published
Title
Published
2026-08-07
Title
Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR
Published
2025-07-25
Title
MinimogWP < 3.9.1 - Unauthenticated Price Manipulation
Published
2026-06-30
Title
Qi Blocks < 1.5.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
Published
2026-07-24
Title
Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR
Published
2026-09-17
Title
Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR