CVE-2026-18983: One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpuaactionprocessoptionupdate function. This is due to insufficient file type validation in wphandleupload() called without a MIME allow-list, with post-write validation relying on the attacker-controlled client-supplied Content-Type header rather than a server-derived type, and no cleanup of files that fail the check. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. in order to exploit this vulnerability an admin has to give subscribers permission to upload avatars. While PHP files and svg files are rejected, dxfp files are accepted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/one-user-avatar-user-profile-pictureto a version that resolves this vulnerability.Fixed in 2.5.4 - Configuration
Do not allow Subscriber+ (subscriber-level and above) to upload avatars; the vulnerability requires an admin to grant subscribers permission to upload avatars.
WordPress (One User Avatar | User Profile Picture plugin) avatar upload permissions for subscribers = disabled for subscriber-level users - Compensating control
After identifying exposed uploads, remove any avatar files uploaded via the plugin that may have bypassed file-type validation, since files failing the check are not cleaned up by the vulnerable code.
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
A site is exposed if it uses an affected version up to 2.5.4 and an administrator has granted subscriber-level or higher users permission to upload avatars. The issue is not exploitable by subscribers unless that avatar-upload permission has been enabled.
What access does an attacker need?
An attacker must be authenticated with at least subscriber-level access and must be able to upload an avatar. No user interaction is required after the attacker has that access and permission.
Are all uploaded file types blocked?
No. The plugin rejects PHP and SVG files, but DXFP files are accepted. File validation relies on an attacker-controlled Content-Type header rather than a server-derived type, and failed validation does not remove the uploaded file.
What is the practical impact?
An authenticated attacker may upload files that are executable, making remote code execution possible. The vulnerability is also classified as stored cross-site scripting, with potential impact to confidentiality, integrity, and availability.
What can be done before patching?
Remove or avoid granting avatar-upload permission to subscriber-level users and other untrusted accounts. Restricting avatar uploads limits the prerequisite required for exploitation.