CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 0.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
Avatar versions 0.1.4 and earlier contain a path traversal vulnerability that allows authenticated users to read, write, or delete files outside the intended directory. An attacker with low-level access can manipulate file paths to access sensitive system files or overwrite critical application data. This vulnerability affects file integrity and availability on affected systems.
What an attacker can do
Read, write, or delete files outside the intended directory on the server.
Potential impact on your site
Attackers with basic user accounts can corrupt or steal files, potentially compromising site data and functionality.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
