EUVD-2026-43440Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
PR:H reflects required high-privilege WordPress account; I:L captures limited profile-picture-only integrity modification with no confidentiality or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through <= 2.6.3.
AnalysisAI
Insecure Direct Object Reference (IDOR) in Cozmoslabs User Profile Picture WordPress plugin (versions through 2.6.3) allows a high-privileged authenticated attacker to modify the profile picture of arbitrary users by manipulating a user-controlled object key in requests. The flaw stems from CWE-639 - the plugin fails to validate that the authenticated user is authorized to modify the target user's resource before processing the change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with its low CVSS score of 2.7.
Technical ContextAI
The vulnerability class is CWE-639 (Authorization Bypass Through User-Controlled Key), the canonical definition of IDOR. The affected component is the metronet-profile-picture WordPress plugin (CPE: cpe:2.3:a:cozmoslabs:user_profile_picture:*:*:*:*:*:*:*:*) published by Cozmoslabs, which provides custom user profile picture functionality within WordPress installations. The flaw exists because the plugin uses a user-supplied key - likely a user ID or post ID referencing a user's avatar attachment - to identify which profile to update, without verifying that the authenticated requester owns or is otherwise authorized to modify that target object. Any user with sufficient WordPress role privileges to invoke the plugin's update endpoint can substitute another user's identifier and alter that user's profile image.
RemediationAI
The primary remediation is to update the User Profile Picture plugin to a version beyond 2.6.3 once the vendor releases a patched build; no specific fixed version number is confirmed in the available intelligence data (patch available per vendor/Patchstack advisory - exact version not independently confirmed). Site administrators should check the WordPress plugin repository or the Patchstack advisory at the reference URL for the latest patched release. As a compensating control while awaiting the patch, restrict the WordPress roles that can invoke profile picture update functionality to only the minimum necessary - if the feature is not required for non-site-admin roles, revoke that capability via a role management plugin. Disabling the plugin entirely eliminates the attack surface with no impact to core WordPress functionality. Given that exploitation requires PR:H credentials, ensuring strong credential hygiene and limiting high-privilege account proliferation also materially limits realistic exposure.
More in User Profile Picture
View allThe REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than
The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_ima
The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, a
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today