The Simple Local Avatars plugin suffers from a missing capability check on the migrate_from_wp_user_avatar function, allowing any authenticated user with at least subscriber-level access to trigger a migration that rewrites avatar metadata for every user on the site. Because this alteration changes data that is typically protected, the impact is primarily the integrity of user avatar information, potentially enabling impersonation or denial of service if avatars are corrupted.

The vulnerability is limited to the 10up Simple Local Avatars plugin version 2.8.4 for WordPress. No other versions or plugins are affected.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS of less than 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no evidence of widespread, targeted use. The attack vector requires an authenticated account, so the risk is principally to sites that grant subscriber-level access and might be exploited by malicious or compromised users with such roles. Because the flaw is a straightforward missing authorization check, an attacker who has logged in can easily invoke the function without additional escalation.