Description

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() called without a MIME allow-list, with post-write validation relying on the attacker-controlled client-supplied Content-Type header rather than a server-derived type, and no cleanup of files that fail the check. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. in order to exploit this vulnerability an admin has to give subscribers permission to upload avatars. While PHP files and svg files are rejected, dxfp files are accepted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T05:16:42.060Z",
  "pubdate": "2026-08-28T05:16:42.060Z",
  "executiveSummary": "The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) and potential Remote Code Execution (RCE) in versions up to and including 2.5.4.\nThe flaw originates from insufficient file type validation during the upload process within the wpua_action_process_option_update function.\nThe vulnerability allows authenticated users with subscriber-level permissions to bypass security controls when the administrative setting for subscriber avatar uploads is enabled.\nBy manipulating the client-supplied Content-Type header, an attacker can upload arbitrary files, such as .dxfp files, which are not correctly sanitized or rejected by the server.\nThe inability of the system to perform robust server-side MIME type verification and the failure to clean up malformed or rejected files poses a significant security risk.\nSuccessful exploitation allows for the execution of malicious scripts in the context of the user's session or potential server-side execution if the environment permits, compromising site integrity and security.",
  "technicalDetails": "The root cause of the vulnerability lies in the implementation of the wpua_action_process_option_update function within the One User Avatar plugin. The plugin utilizes the wp_handle_upload() function without providing a strict MIME allow-list, failing to enforce rigorous file type verification. Consequently, the application relies on the client-supplied Content-Type header to validate file integrity rather than performing server-side inspection or content analysis.\nThe attack vector requires the target WordPress instance to have the 'Allow subscribers to upload avatars' setting enabled. An authenticated attacker with subscriber-level privileges can initiate an avatar upload request, injecting a malicious payload within a file format such as .dxfp. Because the application logic does not strictly filter these file types, the file is persisted to the server storage.\nThe lack of post-write validation and the absence of file cleanup mechanisms upon failed security checks permit the storage of potentially executable or malformed files on the server. If an attacker can successfully upload a file that the server interprets or executes, the impact extends from Stored XSS, allowing for session hijacking or unauthorized administrative actions, to potential Remote Code Execution (RCE) depending on server-side file handling configurations.\nThe attack flow follows a sequential process: first, the attacker authenticates as a user with subscriber access; second, the attacker identifies the avatar upload endpoint managed by wpua_action_process_option_update; third, the attacker transmits a crafted upload request containing an unauthorized file type, such as .dxfp, while manipulating the associated HTTP Content-Type headers to circumvent client-side filters; fourth, the server-side logic processes the upload without verifying the actual file structure, writing the malicious payload to a predictable or accessible directory path.\nBecause the system does not purge files that fail subsequent security heuristics, the persistence of these files allows for multiple stages of exploitation. The reliance on client-provided metadata instead of server-derived mime-types creates a bypass condition where the software assumes the file is safe based on the attacker's own provided information. This architecture leaves the web application exposed to both client-side script injection via XSS and server-side compromise."
}