CVE-2021-24473

The User Profile Picture plugin prior to version 2.6.0 contained an insecure direct object reference vulnerability that permitted users possessing the upload_image capability to modify or remove profile images belonging to other users, even administrators. By default, authors and higher-level roles have this capability, enabling them to exploit the flaw to alter or delete pictures of any user account in the system.

Based on public CVE data (MITRE/NVD).