CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.
Explanation of Vulnerability in Simple Terms
WP User Profile Avatar versions 1.0.6 and earlier lack proper authorization checks, allowing authenticated users to access sensitive profile information they should not see. An attacker with a low-privilege account can read other users' profile data without additional interaction. The vulnerability affects the plugin's core functionality and exposes confidential user details.
What an attacker can do
Read other users' profile information and avatar data without permission.
Potential impact on your site
User privacy is compromised; profile data is exposed to any authenticated user, potentially including email addresses and personal details.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
External resources
