CVE-2021-24170
📋 TL;DR
The User Profile Picture WordPress plugin before version 2.5.0 exposed sensitive user data through its REST API endpoint. Users with upload_files capability could access password hashes, activation keys, emails, and other information. This affects WordPress sites using vulnerable versions of the plugin.
💻 Affected Systems
- User Profile Picture WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain password hashes for all users, enabling offline cracking and potential account takeover across the entire WordPress installation.
Likely Case
Privileged users unintentionally expose sensitive data through API calls, leading to credential compromise for targeted users.
If Mitigated
Limited exposure of non-critical user metadata with proper access controls and monitoring in place.
🎯 Exploit Status
Exploitation requires authenticated access with upload_files capability
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.0
Vendor Advisory: https://wordpress.org/plugins/metronet-profile-picture/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'User Profile Picture' plugin
4. Click 'Update Now' if update available
5. If no update available, download version 2.5.0+ from WordPress repository
6. Deactivate old plugin, upload new version, activate
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the User Profile Picture plugin until patched
wp plugin deactivate metronet-profile-picture
Restrict user capabilities
allRemove upload_files capability from non-administrative users
wp user remove-role <username> author
wp user add-role <username> contributor
🧯 If You Can't Patch
- Implement web application firewall rules to block access to /wp-json/metronet-profile-picture/v1/get_users endpoint
- Monitor and alert on suspicious API calls to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins → Installed PluginsCheck Version:
wp plugin get metronet-profile-picture --field=versionVerify Fix Applied:
Verify plugin version is 2.5.0 or higher and test API endpoint returns only intended data📡 Detection & Monitoring
Log Indicators:
- Multiple GET requests to /wp-json/metronet-profile-picture/v1/get_users
- Unusual API access patterns from user accounts with upload_files capability
Network Indicators:
- HTTP 200 responses containing user password hashes in API responses
- Traffic to REST endpoint from unexpected sources
SIEM Query:
source="wordpress" AND uri_path="/wp-json/metronet-profile-picture/v1/get_users" AND response_status=200🔗 References
- https://wpscan.com/vulnerability/29fc5b0e-0a5f-4484-a1e6-a0a1206726cc
- https://www.wordfence.com/blog/2021/03/medium-severity-vulnerability-patched-in-user-profile-picture-plugin/
- https://wpscan.com/vulnerability/29fc5b0e-0a5f-4484-a1e6-a0a1206726cc
- https://www.wordfence.com/blog/2021/03/medium-severity-vulnerability-patched-in-user-profile-picture-plugin/
