Executive brief
The One User Avatar plugin for WordPress allows users to upload custom profile pictures. Due to insufficient validation of uploaded files, authenticated attackers with subscriber-level access can upload malicious files that execute code on the web server, potentially compromising the entire WordPress site and its user data.
Technical details
The vulnerability is a stored cross-site scripting (XSS) issue in the wpua_action_process_option_update function caused by inadequate file type validation in wp_handle_upload(). The function relies on client-supplied Content-Type headers rather than server-side MIME type detection, and fails to clean up files that fail validation. While PHP and SVG files are blocked, attackers can bypass these restrictions by uploading malicious files with alternative extensions (such as .dxfp files) that may be executed by the server. Exploitation requires that the WordPress administrator has enabled avatar uploads for subscribers, and an authenticated attacker with at least subscriber-level privileges can then upload executable code, leading to remote code execution.
Affected products
- WordPress The One User Avatar | User Profile Picture up to and including 2.5.4
Timeline
- 2026-08-28: disclosed