CVE-2024-10789 is a CSRF vulnerability in the WP User Profile Avatar plugin for WordPress, affecting all versions up to 1.0.5. The vulnerability arises from missing or incorrect nonce validation in the wpupa_user_admin() function, which handles plugin settings. An attacker can exploit this by crafting a forged request that, when executed by an authenticated administrator (e.g., clicking a malicious link), updates plugin settings without proper authorization checks. This can lead to unauthorized changes in plugin behavior or access control settings.

The vulnerability allows an attacker to cause an authenticated administrator to unknowingly modify plugin settings, potentially altering access controls or functionality. The CVSS score of 4.3 reflects a medium severity impact focused on integrity, with no direct confidentiality or availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests that could trigger plugin settings changes. Implementing additional protective measures such as web application firewalls or custom nonce validation may help mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.