CVE-2021-24170: 
WordPress vulnerability analysis and mitigation

CVE-2021-24170 is a sensitive information disclosure vulnerability discovered in the User Profile Picture WordPress plugin versions before 2.5.0. The vulnerability was publicly disclosed on March 3, 2021, and affects the REST API endpoint get_users functionality. The issue was identified by security researcher Chloe Chamberland and impacts the metronet-profile-picture WordPress plugin (WPScan).

The vulnerability exists in the REST API endpoint get_users which exposed excessive information to users with the upload_files capability. The exposed data included sensitive information such as password hashes, hashed user activation keys, usernames, emails, and other less sensitive data. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. It is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability could allow attackers with upload_files capability to access sensitive user information including password hashes, hashed user activation keys, usernames, and email addresses. This exposure of sensitive data could potentially lead to unauthorized access to user accounts if the obtained information is successfully exploited (WPScan).

The vulnerability has been verified and proof of concept code is available. It requires an attacker to have upload_files capability on the WordPress installation to exploit. The vulnerability is classified as medium severity with a CVSS score of 6.5 (WPScan).

The vulnerability has been patched in version 2.5.0 of the User Profile Picture plugin. Users are advised to update to this version or later to mitigate the risk. The fix was released after the vendor Cozmoslabs was notified of the vulnerability (Wordfence).