CVE-2021-24675

CVE-2021-24675: One User Avatar < 2.3.7 - Avatar Update via CSRF

Vendor Unknown
Product One User Avatar | User Profile Picture
Weakness CWE-352 · CSRF
Published October 18, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack

Key dates

02Disclosure timeline

October 18, 2021 CVE published
August 3, 2024 Record updated