Security readout for executives and security teams
Plain-English summary
This affects WordPress sites using the User Profile Picture plugin before 2.6.0. A user with image-upload permissions could change or remove another user’s profile picture, including an administrator’s. Sources do not indicate full account takeover, code execution, or data theft.
Executive priority
Treat as a contained integrity issue unless the site relies heavily on trusted profile identity. Prioritize updating affected WordPress sites and reviewing author permissions, especially on multi-author, agency, community, or customer-contributor sites.
Technical view
CVE-2021-24473 is an IDOR issue mapped to CWE-639. The plugin failed to properly enforce authorization on profile picture change or deletion actions, allowing users with upload_image capability, author and above by default, to affect other users’ profile pictures.
Likely exposure
Exposure is limited to WordPress installations running User Profile Picture before 2.6.0 with authenticated users who have upload_image capability. Sites without this plugin, or with no lower-trust authors or contributors granted upload_image, are less exposed.
Exploitation context
The provided sources do not show KEV listing or active exploitation. Exploitation requires an authenticated user with image-upload permissions. The business risk is profile integrity abuse, potential impersonation, and nuisance disruption rather than a confirmed path to system compromise.
Researcher notes
Evidence is limited: no CVSS vector is provided in the source bundle, and exploitation status is not confirmed. Focus analysis on authorization checks around target user identifiers for profile picture update and deletion operations.
Mitigation direction
- Update User Profile Picture to version 2.6.0 or later.
- Review which roles and users have upload_image capability.
- Restrict author-level access for untrusted or external contributors.
- Check vendor and WPScan guidance for any additional remediation.
- Monitor for unexpected profile picture changes or deletions.
Validation and detection
- Inventory WordPress sites using the User Profile Picture plugin.
- Confirm installed plugin versions are 2.6.0 or later.
- Review WordPress roles for upload_image capability exposure.
- Check recent profile picture changes for unauthorized activity.
- Verify lower-trust users cannot alter other users’ profile pictures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24473 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/79982ea9-4733-4b1e-a43e-17629c1136deCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.