The vulnerability is an Insecure Direct Object Reference (IDOR) that allows a user to manipulate a user‑controlled key to bypass authorization checks. Attackers can retrieve or modify avatar data belonging to other users by supplying a different user identifier in the request. This can expose private avatar information and alter data integrity, causing unauthorized disclosure or modification of user resources.

The flaw affects the WordPress Simple User Avatar plugin provided by Matteo Manna, specifically all releases up to and including version 4.9. The affected range is indicated as n/a through 4.9, meaning any installed instance of the plugin in that version window is vulnerable. The product is commonly integrated into WordPress installations that handle user avatars.

The CVSS score of 4.3 suggests a low‑to‑moderate severity, and the EPSS score is currently unavailable, so the likelihood of widespread exploitation cannot be determined from the data. The vulnerability is not listed in CISA KEV, implying no known public exploit at the time of reporting. The likely attack vector is remote and opportunistic, using the plugin’s web interface or API endpoints to supply the manipulated key. The attacker would need access to the site and the ability to send crafted requests, but no additional privileges are required beyond a normal authenticated session.