Simple Local Avatars Missing Authorization Vulnerability in WordPress

A vulnerability exists in the Simple Local Avatars plugin for WordPress, specifically in version 2.8.4, allowing unauthorized data modification. The issue arises from a lack of capability checks in the 'migrate_from_wp_user_avatar()' function. This flaw enables authenticated attackers with subscriber-level access or higher to migrate avatar metadata for all users.

Impact

Exploitation of this vulnerability allows for unauthorized migration of avatar metadata, potentially leading to incorrect or malicious avatar representations for users.

Reproduction

To reproduce this vulnerability, an authenticated user with subscriber-level access can initiate the migration of WP User Avatar data to Simple Local Avatars. This can be done through the WordPress admin interface or via a WP-CLI command, without the necessary permissions to perform such an action.

Remediation

Users are advised to update the Simple Local Avatars plugin to version 2.8.5 or later, where this vulnerability has been patched.