توضیحات
Set a custom profile image (avatar) for a user using the standard WordPress media upload tool.
تغییرات این نسخه
2.6.4
Released 2026-07-07
Security fix: hardened the AJAX and REST endpoints that set, retrieve, and remove profile pictures against Insecure Direct Object Reference (IDOR) access. Requests are now validated so a user can only act on their own profile picture (unless they have the capability to edit other users), and the referenced post must be the user’s own profile-picture post.
Security hardening: validated that the referenced media is a real attachment before it is assigned, and required an authenticated capability check on the profile-image REST route.
Security hardening: added a capability check and nonce verification to the “migrate to Profile Builder” admin-notice dismissal.
Tested up to WordPress 7.0.
2.6.3
Released 2024-07-18
Migrated functionality to Profile Builder plugin where it will be actively maintained. You can keep the current plugin as is or migrate to Profile Builder to receive future updates.
2.6.2
Released 2024-06-20
Security improvements
2.6.1
Released 2023-09-28
Fixed php warning.
2.6.0
Released 2021-06-25
Fixed a security flaw where a user can change others profile picture.
2.5.0
Released 2021-02-18
Medium level (6.5) security fix. Please update as soon as possible.
Cleaned up REST user data so only pertitent information is returned to prevent user data leakage to roles with the upload_files capability.
2.4.0
Released 2020-11-17
Fixing REST issues.
Cleaning up dist scripts.
General code cleanup.
2.3.11
Released 2020-02-29
Released 2026-07-07
Security fix: hardened the AJAX and REST endpoints that set, retrieve, and remove profile pictures against Insecure Direct Object Reference (IDOR) access. Requests are now validated so a user can only act on their own profile picture (unless they have the capability to edit other users), and the referenced post must be the user’s own profile-picture post.
Security hardening: validated that the referenced media is a real attachment before it is assigned, and required an authenticated capability check on the profile-image REST route.
Security hardening: added a capability check and nonce verification to the “migrate to Profile Builder” admin-notice dismissal.
Tested up to WordPress 7.0.
2.6.3
Released 2024-07-18
Migrated functionality to Profile Builder plugin where it will be actively maintained. You can keep the current plugin as is or migrate to Profile Builder to receive future updates.
2.6.2
Released 2024-06-20
Security improvements
2.6.1
Released 2023-09-28
Fixed php warning.
2.6.0
Released 2021-06-25
Fixed a security flaw where a user can change others profile picture.
2.5.0
Released 2021-02-18
Medium level (6.5) security fix. Please update as soon as possible.
Cleaned up REST user data so only pertitent information is returned to prevent user data leakage to roles with the upload_files capability.
2.4.0
Released 2020-11-17
Fixing REST issues.
Cleaning up dist scripts.
General code cleanup.
2.3.11
Released 2020-02-29