The Simple Local Avatars plugin for WordPress has a security issue in version 2.8.4. This means that someone without proper permission can change the data. This happens because the plugin does not check if a user has the right capabilities before using the migrate_from_wp_user_avatar() function. As a result, anyone with subscriber-level access or higher can change the avatar information for all users.