This vulnerability in WP User Profile Avatar (<= 1.0.6) arises from missing authorization checks, leading to incorrectly configured access control security levels. It allows users with limited privileges to exploit the lack of proper authorization controls. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction needed, and limited confidentiality impact without integrity or availability impact.

The vulnerability could allow an attacker with limited privileges to perform unauthorized actions related to user profile avatars, potentially leading to limited confidentiality exposure. There is no impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict user privileges to minimize risk. Monitor vendor channels for updates and apply patches promptly once released.