The User Profile Picture plugin for WordPress, versions up to and including 2.6.1, contains an authorization bypass vulnerability (CWE-639) due to insufficient validation of a user-controlled key in the 'rest_api_change_profile_image' REST API function. Authenticated attackers with Author-level privileges or above can exploit this to change the profile picture of arbitrary users. The vulnerability is classified as an insecure direct object reference (IDOR). The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and no user interaction required, but limited impact to integrity only. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

An attacker with Author-level or higher access can modify the profile pictures of other users without authorization. This impacts the integrity of user profile data but does not affect confidentiality or availability. There is no evidence of exploitation in the wild. The vulnerability could be used to cause confusion or impersonation by changing profile images, but it does not allow privilege escalation or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level permissions to trusted users only and monitor plugin updates from cozmoslabs. Consider disabling or replacing the User Profile Picture plugin if possible to mitigate risk.