CVE-2026-18983

CVE-2026-18983 is an unrestricted file upload flaw (classified as stored cross-site scripting, CWE-434) in the One User Avatar | User Profile Picture plugin for WordPress, affecting all versions up to and including 2.5.4. The wpua_action_process_option_update function calls wp_handle_upload() without a MIME allow-list, then validates the file using the attacker-controlled client-supplied Content-Type header instead of a server-derived type, and files that fail the check are not cleaned up, so an authenticated attacker with subscriber-level access or above can upload files that may be executable (per the advisory, PHP and SVG uploads are rejected but .dxfp files are accepted). Exploitation additionally requires that a site administrator has granted subscribers permission to upload avatars; a successful attacker can achieve stored cross-site scripting and potentially remote code execution by landing an executable file on the server (CVSS 3.1: 7.5 high). Any WordPress site running the plugin at version 2.5.4 or earlier, with subscriber avatar uploads enabled, is affected. There is currently no evidence of exploitation in the wild and no known public proof-of-concept, with EPSS estimating only about a 0.5% probability of exploitation in the next 30 days.

What to do: Update the One User Avatar | User Profile Picture plugin to the first patched release (any version newer than 2.5.4) as soon as it is available. Until then, revoke subscribers' avatar-upload permission in the plugin settings and restrict uploads to trusted roles. Also review the WordPress uploads directory for unexpected executable or .dxfp files uploaded by low-privileged accounts and remove anything suspicious.