EUVD-2026-40056
GHSA-9324-w765-4vq2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible IDOR requiring a valid WordPress account (PR:L); no integrity or availability impact confirmed per description and CVSS signals.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Simple User Avatar: from n/a through 4.9.
AnalysisAI
Insecure Direct Object Reference (IDOR) in the Simple User Avatar WordPress plugin through version 4.9 allows authenticated low-privileged users to bypass authorization controls and access avatar-related resources belonging to other users by manipulating user-controlled object keys. The root cause (CWE-639) is the plugin's failure to verify that the requesting user owns or is authorized to access the referenced object. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to CISA KEV, though the low complexity and low privilege requirement (PR:L, AC:L per CVSS) mean any registered WordPress user on an affected site could trivially exploit it.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) describes a vulnerability class where an application accepts a user-supplied identifier - such as a numeric user ID or filename - to reference a server-side object without confirming the requester is authorized to access that specific object. In Simple User Avatar (CPE: cpe:2.3:a:matteo_manna:simple_user_avatar:*:*:*:*:*:*:*:*), the plugin most likely processes avatar-related requests using a user ID or media object reference supplied in the request, then retrieves or returns the associated resource without an ownership or permission check. This is the canonical IDOR pattern, and Patchstack's tagging of the issue explicitly as an IDOR corroborates this reading. The plugin runs within WordPress and inherits WordPress's authentication layer, but the authorization gap exists at the plugin-level object access check rather than at login.
RemediationAI
The primary fix is to update Simple User Avatar to a version beyond 4.9 once a patched release is made available by the developer. No patched version has been confirmed in the current intelligence data; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/simple-user-avatar/vulnerability/wordpress-simple-user-avatar-plugin-4-9-insecure-direct-object-references-idor-vulnerability and the WordPress plugin repository should be monitored for an updated release. As an interim compensating control, administrators can deactivate the Simple User Avatar plugin entirely, which eliminates the attack surface at the cost of disabling all avatar management functionality for site users. Alternatively, if the site permits open registration, disabling new user registrations reduces the pool of potential low-privilege attackers, though it does not mitigate risk from existing accounts. Restricting sensitive plugin endpoints via a Web Application Firewall to block unexpected user ID parameter values is a partial mitigation but may interfere with legitimate plugin operation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today