One User Avatar User Profile Picture
Monthly
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.