Description
Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.
Published: 2026-04-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to plugin function data
Action: Patch
AI Analysis

Impact

The plugin suffers from a missing authorization check that allows users to bypass normal access control settings. This flaw can enable an attacker to view or modify avatar listings or possibly interact with the underlying data structures that the plugin manages, compromising the confidentiality and integrity of user avatar information.

Affected Systems

The vulnerability affects the WordPress Author Avatars List/Block plugin released by Paul Bearne. Any installation using version 2.1.25 or earlier is impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk level, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. It is inferred that the attack vector is via unauthenticated or insufficiently privileged web requests to the WordPress site hosting the plugin, as the vulnerability arises from incorrect access control configuration.

Generated by OpenCVE AI on April 8, 2026 at 16:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Author Avatars List/Block plugin to version 2.1.26 or newer.
  • If an update is not yet available, consider disabling the plugin until a patch is applied.
  • Check the plugin configuration to ensure that access controls are properly enforced and that no default permissions grant broader access than intended.

Generated by OpenCVE AI on April 8, 2026 at 16:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Apr 2026 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Bearne
Bearne author Avatars List/block
Wordpress
Wordpress wordpress
Vendors & Products Bearne
Bearne author Avatars List/block
Wordpress
Wordpress wordpress

Wed, 08 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Apr 2026 08:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.
Title WordPress Author Avatars List/Block plugin <= 2.1.25 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Bearne Author Avatars List/block
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-29T09:52:04.011Z

Reserved: 2026-04-07T10:58:10.483Z

Link: CVE-2026-39690

cve-icon Vulnrichment

Updated: 2026-04-08T14:33:41.559Z

cve-icon NVD

Status : Deferred

Published: 2026-04-08T09:16:41.110

Modified: 2026-04-24T18:05:35.730

Link: CVE-2026-39690

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-09T08:21:59Z

Weaknesses