WP User Avatar worked for years without any issues. Yesterday the "ProfilePress" version suddenly allowed an attacker to register administrator accounts on a popular website that I manage. Now I have zero trust in the developer and deleted the plugin entirely and forever.

ProfilePress is not WP User Avatar, and it should not be allowed to live and update itself under the original WP-User-Avatar plugin folder. It should not be possible for plugins that are currently installed on 400,000 sites to suddenly transform themselves into something else that we did not choose to install. Seems like a massive security risk.