CVE-2022-0442: UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-07 · updated 2026-06-17
Weakness: CWE-639

Description

The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.

Affected products

stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: before 1.2.3.1 — fixed in 1.2.3.1

How to fix

Upgrade to a fixed version: stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP 1.2.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-0442 or the next vulnerability affects your stack