Simple User Avatar

Simple User Avatar has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (100%).

The one issue recorded for Simple User Avatar has a vendor fix available, so running the current release closes it.

All of these findings were reported by Ananda Dhakal. Simple User Avatar is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

4.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Simple User Avatar vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2026-57676

Simple User Avatar <= 4.9 - Authenticated (Subscriber+) Insecure Direct Object Reference

Read the full analysis

Vulnerability Records

1 records


2026-06-29 00:00	Simple User Avatar <= 4.9 - Authenticated (Subscriber+) Insecure Direct Object Reference Simple User Avatar <= 4.9	`CVE-2026-57676`	4.3 Medium	Ananda Dhakal	Yes

Showing 1–1 of 1 reports

Latestv5.1

Simple User Avatar

Author

Matteo Manna

4.6(18)

92/100

Last Updated

2026-06-29 (2mo ago)

Active Installs

20,000+

Downloads

252,211

Requires WP

4.0+

Requires PHP

8.0+

Tested up to

WP 7.0.4

Created

2017-03-07 (10y ago)

This plugin simplifies the life of WordPress users. Now users can add or remove their avatar simply using images from his Media Library. Simple to use, no additional functions required. Plugin available on GitHub.

View on WordPress.org