CVE-2026-61971: User Profile Picture Auth Bypass Flaw

CVE-2026-61971 Overview

CVE-2026-61971 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in the Cozmoslabs User Profile Picture WordPress plugin (metronet-profile-picture). The flaw affects all versions up to and including 2.6.3. An authenticated attacker with high privileges can manipulate user-controlled identifiers to access or modify profile picture data belonging to other users. The issue is classified as an Insecure Direct Object Reference (IDOR) and stems from incorrectly configured access control on plugin endpoints.

Critical Impact
An authenticated user can bypass authorization checks by supplying another user's identifier, leading to limited integrity impact across WordPress accounts using the plugin.

Affected Products

Cozmoslabs User Profile Picture (metronet-profile-picture) plugin for WordPress
All versions from n/a through 2.6.3
WordPress sites with the plugin activated and accessible to authenticated users

Discovery Timeline

2026-07-13 - CVE-2026-61971 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-61971

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) affecting the metronet-profile-picture plugin. The plugin exposes functionality that accepts a user identifier as an input parameter without adequately verifying whether the requesting account owns that identifier. An authenticated attacker can substitute another user's ID in the request and manipulate resources associated with that account.

The issue falls under [CWE-639: Authorization Bypass Through User-Controlled Key]. Exploitation requires network access and existing authenticated privileges on the target site. The impact is limited to integrity, meaning an attacker can alter data such as profile picture assignments, but the vulnerability does not expose confidential information or disrupt availability.

According to the Exploit Prediction Scoring System, the likelihood of exploitation in the wild is low. No public proof-of-concept, exploit code, or evidence of active exploitation has been reported.

Root Cause

The root cause is missing or improperly implemented ownership validation on requests that reference user objects by ID. The plugin trusts the user-supplied key rather than deriving the target user from the authenticated session or enforcing a capability check tied to the object owner. This design mistake allows horizontal privilege escalation between accounts.

Attack Vector

The attack vector is network based over HTTP(S) against a WordPress site running a vulnerable version of the plugin. The attacker must first authenticate to the target site. Once authenticated, the attacker crafts a request to the vulnerable plugin endpoint and substitutes another account's user identifier in place of their own. The server processes the request without validating ownership and performs the requested action on the victim's profile picture data.

No code example is available from verified sources. Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-61971

Indicators of Compromise

Unexpected changes to WordPress user profile pictures or associated metadata attributed to accounts other than the acting user.
HTTP requests to metronet-profile-picture plugin endpoints containing a user_id parameter that does not match the authenticated session user.
Repeated authenticated requests iterating through sequential user IDs, indicative of enumeration.

Detection Strategies

Review WordPress access logs for authenticated requests to plugin endpoints where the referenced user ID differs from the session owner.
Correlate profile update events in the WordPress database with the acting user's session to detect ownership mismatches.
Compare current plugin version against the fixed release and flag any host running 2.6.3 or earlier.

Monitoring Recommendations

Enable verbose audit logging of WordPress user meta changes and profile picture attachment events.
Alert on authenticated HTTP requests that contain object identifiers inconsistent with the authenticated cookie or nonce.
Baseline normal plugin traffic patterns and generate alerts for high-frequency requests iterating user IDs.

How to Mitigate CVE-2026-61971

Immediate Actions Required

Upgrade the Cozmoslabs User Profile Picture (metronet-profile-picture) plugin to a version above 2.6.3 as soon as a fixed release is available.
Audit existing WordPress accounts for unexpected profile picture changes and review associated logs.
Restrict low-trust authenticated roles from accessing the plugin's endpoints where feasible.

Patch Information

Refer to the Patchstack Vulnerability Report for the vendor's remediation status. Apply any plugin update released after version 2.6.3 through the WordPress plugin management interface.

Workarounds

Temporarily deactivate the metronet-profile-picture plugin until a fixed version is installed.
Apply a web application firewall (WAF) rule to block requests to plugin endpoints where the user_id parameter does not match the authenticated session identifier.
Limit user registration and reduce the number of low-privilege authenticated accounts on exposed WordPress sites.

bash

# Example WordPress CLI command to check installed plugin version
wp plugin get metronet-profile-picture --field=version

# Deactivate the plugin as a temporary workaround
wp plugin deactivate metronet-profile-picture