User Profile Picture – Custom Local Avatars
User Profile Picture – Custom Local Avatars has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2021; all 2 are fixed as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 6.5 out of 10. 2021 was the busiest year with 2 disclosures.
The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (50%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor.
Every one of the 2 issues recorded for User Profile Picture – Custom Local Avatars has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. User Profile Picture – Custom Local Avatars is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2021-24170User Profile Picture <= 2.4.0 - Sensitive Information Disclosure
Read the full analysisVulnerability Records
User Profile Picture – Custom Local Avatars
Author
Dew Technolab
User Profile Picture gives any user a custom profile picture, a local avatar chosen from the WordPress Media Library, instead of their Gravatar. Choose the picture on the user’s profile screen with the standard WordPress media uploader. From then on it appears everywhere WordPress shows that user’s avatar: comments, author boxes, the admin toolbar, the Users list, the Avatar block, the REST API, and any theme or plugin that uses get_avatar() or get_avatar_url(), such as page builder author boxes and GraphQL APIs. Features Custom profile picture for any user, chosen or uploaded with the native WordPress media uploader. Shown everywhere avatars appear: comments, post authors, the admin toolbar, the Users screen, the Avatar and Post Author blocks, and themes and plugins that call get_avatar() or get_avatar_url(). Avatar URLs in the REST API (avatar_urls) and in plugins that ask for the avatar URL, such as page builder widgets and GraphQL APIs, use the custom picture too. Remove the picture with one click to go back to the Gravatar. Pictures are served from your own site, so users don’t need a Gravatar account. Users without a custom picture keep their Gravatar or your default avatar. Keeps the size, alt text, CSS classes and lazy loading your theme asks for. Set the picture when creating a user on Users > Add New. Lightweight: no settings page, and the media uploader loads only on the user screens. Works with block themes, classic themes and multisite. For developers: the dew_profile_img() function and the dpp_avatar_classes filter. How it works Go to Users and open a user’s profile, or your own. Under Profile Picture, click Upload and choose or upload an image. Click Update Profile. The picture now replaces that user’s Gravatar across your site. To go back to the Gravatar, click Remove under the picture and then Update Profile. Profile pictures are set by administrators (users who can edit other users), for any user including themselves. Like the plugin? Please consider leaving a review. It helps other people find it.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C