CVE-2024-10789: WP User Profile Avatar CSRF Vulnerability

CVE-2024-10789 Overview

CVE-2024-10789 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP User Profile Avatar plugin for WordPress. The flaw affects all versions up to and including 1.0.5. The root cause is missing or incorrect nonce validation on the wpupa_user_admin() function. Unauthenticated attackers can update plugin settings that control access to functionality by tricking a site administrator into clicking a crafted link. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker who successfully lures a WordPress administrator can alter plugin settings without authorization, weakening access controls on avatar management functionality.

Affected Products

WP User Profile Avatar plugin for WordPress
All versions up to and including 1.0.5
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2025-01-16 - CVE-2024-10789 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10789

Vulnerability Analysis

The WP User Profile Avatar plugin exposes an administrative handler, wpupa_user_admin(), that processes settings updates without verifying a valid WordPress nonce. WordPress nonces are single-use tokens that bind a state-changing request to a specific user session. Without this check, the plugin cannot confirm that a settings-change request actually originated from the administrator's browser session.

An attacker crafts a malicious page or link containing the settings-update request. When an authenticated administrator visits the page, the browser automatically submits the request with the admin's session cookies. The plugin processes the request as legitimate.

Exploitation is limited to modifying the plugin setting that controls access to the avatar functionality. The scope is bounded (integrity impact only), but the flaw undermines the intended access model of the plugin.

Root Cause

The root cause is the absence of a wp_verify_nonce() (or equivalent check_admin_referer()) call inside the wpupa_user_admin() function before the settings update logic executes. WordPress core provides these primitives specifically to prevent CSRF, and the plugin failed to invoke them on this state-changing endpoint.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a page containing a hidden form or image tag that issues the forged request to the target WordPress site. Delivery typically occurs through phishing, comment spam, or a compromised third-party page loaded in the admin's browser. No prior authentication is required on the attacker's side; the victim administrator's session supplies the necessary privileges.

Because no verified proof-of-concept code is published for this CVE, refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the patched code diff.

Detection Methods for CVE-2024-10789

Indicators of Compromise

Unexpected changes to WP User Profile Avatar plugin settings that administrators did not initiate
HTTP POST requests to wp-admin endpoints associated with the plugin containing a valid admin session cookie but a Referer header from an unrelated external domain
Requests to plugin admin endpoints that lack the _wpnonce parameter

Detection Strategies

Review WordPress audit logs for plugin option changes correlated with administrator browsing activity on external sites
Monitor web server access logs for admin-area POST requests originating from off-site referers
Use a WordPress activity logging plugin to capture update_option events tied to the WP User Profile Avatar plugin

Monitoring Recommendations

Enable audit logging for all administrator sessions and settings-change events
Alert on any admin-panel state changes where the HTTP Referer is not the WordPress site's own hostname
Track plugin version inventory across managed WordPress sites and flag installations still running version 1.0.5 or earlier

How to Mitigate CVE-2024-10789

Immediate Actions Required

Update the WP User Profile Avatar plugin to a version later than 1.0.5 that includes the fix from changeset 3222923
If a patched version is unavailable for your environment, deactivate and remove the plugin
Review current plugin settings and restore them to the intended configuration

Patch Information

The fix is committed in the WordPress.org plugin repository as changeset 3222923, which introduces nonce validation on the affected administrative handler. Administrators should install the latest available version through the WordPress plugin updater. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Restrict WordPress administrator accounts to dedicated browsers or browser profiles used only for site management
Deploy a Web Application Firewall rule that blocks POST requests to plugin admin endpoints when the Referer header is missing or off-site
Enforce short administrator session lifetimes and require re-authentication before accessing plugin settings pages

bash

# Example WP-CLI command to inventory and update the affected plugin
wp plugin get wp-user-profile-avatar --field=version
wp plugin update wp-user-profile-avatar