CVE-2025-8482

The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on the migrate_from_wp_user_avatar() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to migrate avatar metadata for all users.

• CWE-862

• https://plugins.trac.wordpress.org/browser/simple-local-avatars/tags/2.8.4/includes/class-simple-local-avatars.php#L123
• https://plugins.trac.wordpress.org/browser/simple-local-avatars/tags/2.8.4/includes/class-simple-local-avatars.php?marks=1663-1672#L1663
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340223%40simple-local-avatars&new=3340223%40simple-local-avatars&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/69d78334-2b38-43ee-acf6-c073d5826213?source=cve

Published

Aug 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-8475Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code…7.4
• CVE-2025-8476Alpine iLX-507 TIDAL Improper Certificate Validation Vulnera…8
• CVE-2025-8477Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Rem…7.4
• CVE-2025-8479The Zoho Flow plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2025-8480Alpine iLX-507 Command Injection Remote Code Execution. This…8
• CVE-2025-8481The Blog Designer For Elementor – Post Slider, Post Carousel…4.3
• CVE-2025-8483The The Discussion Board – WordPress Forum Plugin plugin for…6.3
• CVE-2025-8484The Code Quality Control Tool plugin for WordPress is vulner…5.3
• CVE-2025-8485An improper permissions vulnerability was reported in Lenovo…7.3
• CVE-2025-8486A potential vulnerability was reported in PC Manager that co…8.5
• CVE-2025-8487The Kubio AI Page Builder plugin for WordPress is vulnerable…5.4
• CVE-2025-8488The Ultimate Addons for Elementor (Formerly Elementor Header…4.3