CVE-2021-24675 — One User Avatar < 2.3.7 - Avatar Update via CSRF
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers c…
Published: 2021-10-18 · CVSS: Unscored
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7