One User Avatar CVE-2026-18983

Two concrete prerequisites must both be satisfied: (1) the attacker must hold a valid WordPress account at subscriber level or above - unauthenticated exploitation is not possible given PR:L in the CVSS vector; (2) a site administrator must have explicitly enabled the non-default setting that allows subscribers to upload avatars - without this grant, the vulnerable upload code path is unreachable by low-privileged users. What limits exploitation: the admin configuration requirement is the dominant gating factor; default WordPress installations do not grant subscribers avatar upload rights. Additionally, PHP and SVG file types are explicitly rejected by the plugin, narrowing the usable payload formats to types like DXFP that escape the blocklist. Sites with closed user registration face negligible risk unless an insider threat is considered.

The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 7.5, which accurately reflects the dual conditions required: subscriber-level authentication (PR:L) and a non-default administrator decision to enable subscriber avatar uploads (AC:H). Without that administrative grant, exploitation is impossible regardless of CVSS impact metrics. No EPSS score was provided; no CISA KEV listing is present; no public POC is known - all of which temper urgency despite the high theoretical impact. Real-world risk is meaningfully lower than a naïve CVSS read suggests: the combination of needing a registered account and an explicit admin misconfiguration creates a significant barrier. However, multi-tenant WordPress environments (shared hosting, SaaS-style site builders) where subscriber registration is open and avatar permissions are loosely managed face material exposure. The severity escalates sharply if those two conditions are met, since successful exploitation yields full server-side RCE.

An attacker registers or compromises a subscriber-level account on a WordPress site where the administrator has enabled avatar uploads for subscribers. The attacker submits a crafted DXFP file with executable server-side content via the avatar upload endpoint, supplying a benign Content-Type header to bypass MIME validation; the file is written to the uploads directory and retained even if the post-write check flags it. The attacker then requests the file's URL directly, triggering server-side execution and achieving RCE under the web server's process identity.