EUVD-2026-67408
GHSA-p2qh-mgvf-5q7f
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the non-default admin configuration prerequisite; PR:L reflects required subscriber authentication; full C/I/A impact reflects RCE potential on the vulnerable WordPress host.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() called without a MIME allow-list, with post-write validation relying on the attacker-controlled client-supplied Content-Type header rather than a server-derived type, and no cleanup of files that fail the check. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. in order to exploit this vulnerability an admin has to give subscribers permission to upload avatars. While PHP files and svg files are rejected, dxfp files are accepted.
AnalysisAI
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must both be satisfied: (1) the attacker must hold a valid WordPress account at subscriber level or above - unauthenticated exploitation is not possible given PR:L in the CVSS vector; (2) a site administrator must have explicitly enabled the non-default setting that allows subscribers to upload avatars - without this grant, the vulnerable upload code path is unreachable by low-privileged users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 7.5, which accurately reflects the dual conditions required: subscriber-level authentication (PR:L) and a non-default administrator decision to enable subscriber avatar uploads (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available via plugin changeset 3659509, which transitions the codebase from the 2.5.4 tag to the 2.5.5 tag (see https://plugins.trac.wordpress.org/changeset?old_path=%2Fone-user-avatar/tags/2.5.4&new_path=%2Fone-user-avatar/tags/2.5.5); the patched released version is inferred as 2.5.5 but not independently confirmed as a WordPress.org repository release at time of analysis - verify availability in the plugin directory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether the One User Avatar plugin is installed and identify whether your WordPress configuration grants subscriber-level users avatar upload capability via wp-admin settings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today