CVE-2026-18983: CWE-434 Unrestricted Upload of File with Dangerous Type in onedesigns One User Avatar | User Profile Picture

CVE-2026-18983 is a vulnerability in the One User Avatar | User Profile Picture WordPress plugin affecting all versions up to and including 2.5.4. The flaw is due to insufficient validation of uploaded file types in the wp_handle_upload() function, which is called without a MIME allow-list. Post-upload validation depends on the attacker-controlled Content-Type header rather than a server-derived MIME type, and files failing validation are not cleaned up. This allows authenticated users with subscriber-level permissions or higher to upload potentially executable files, enabling stored cross-site scripting and possible remote code execution if admin permissions allow subscribers to upload avatars. PHP and SVG files are blocked, but DXFP files are accepted, which can be abused.

An attacker with subscriber-level access or higher can upload files that may be executable, leading to stored cross-site scripting and potentially remote code execution. This could compromise the affected WordPress site if an administrator permits subscribers to upload avatars. The vulnerability impacts confidentiality, integrity, and availability of the system as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid granting subscribers permission to upload avatars. Monitoring and restricting file upload permissions can reduce risk. Do not rely on client-supplied Content-Type headers for validation. Consider disabling or replacing the plugin if possible.