WordPress plugin
Woocommerce Custom Profile Picture security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High0
- Medium0
- Low0
All Woocommerce Custom Profile Picture vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Authenticated (Subscriber+) Arbitrary File Upload ≤1.0No patch available | CVE-2024-49658 |
- Critical9.8Authenticated (Subscriber+) Arbitrary File Upload
≤1.0No patch available
Woocommerce Custom Profile Picture: common questions
Does Woocommerce Custom Profile Picture have known vulnerabilities?
Yes. VulnCrest Radar lists 1 known vulnerability in Woocommerce Custom Profile Picture: 1 critical. At least one is not fixed in the latest version.
How do I check which version of Woocommerce Custom Profile Picture I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Woocommerce Custom Profile Picture vulnerability?
CVE-2024-49658, published Oct 21, 2024: Woocommerce Custom Profile Picture <= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload. Severity: Critical (CVSS 9.8).
Is any Woocommerce Custom Profile Picture vulnerability listed in CISA KEV?
No. None of the known Woocommerce Custom Profile Picture vulnerabilities is currently listed in the CISA KEV catalog.