CVE-2026-61971

LowCVSS 2.7

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

The User Profile Picture WordPress plugin (versions up to 2.6.3) contains an authorization bypass vulnerability through a user-controlled key. This allows an attacker to exploit incorrectly configured access control security levels.

Risk Assessment

An attacker can gain unauthorized access to protected functions or data, potentially leading to confidentiality and integrity breaches.

Recommendation

Immediately update the User Profile Picture plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through <= 2.6.3.