CVE-2023-6384

Description

The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar

Reserved 2023-11-29 | Published 2024-01-22 | Updated 2024-10-21 | Assigner WPScan

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status
unaffected

Any version before 1.0.1
affected

Credits

Dmitrii Ignatyev finder

WPScan coordinator

References

wpscan.com/...rability/fbdefab4-614b-493b-a9ae-c5aeff8323ef/ exploit vdb-entry technical-description

cve.org (CVE-2023-6384)

nvd.nist.gov (CVE-2023-6384)

Download JSON