title: WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
description: The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar
problem types: CWE-639 Authorization Bypass Through User-Controlled Key
affected:
{
vendor: Unknown
product: WP User Profile Avatar
versions:
status: affected, versionType: semver, version: 0, lessThan: 1.0.1
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}