PT-2026-51737 · Ultimate Member · The Ultimate Member – User Profile
Kevin Wydler
·
Publicado
2026-06-24
·
Atualizado
2026-06-24
·
CVE-2026-7761
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: (1) an MD5 hash fallback in get directory by hash() that allows any post to be used as a member directory by computing SUBSTRING(MD5(post id), 11, 5), (2) a strstr() parsing logic flaw in post data() that allows bypassing WordPress's protected meta key restrictions by placing ' um ' anywhere in the meta key name rather than at the start, and (3) missing field name validation in build user card data() that allows arbitrary field names including 'password reset link' to be passed to um filtered value(). This makes it possible for authenticated attackers with Contributor-level access and above to create a malicious post via XMLRPC with crafted meta fields, use the MD5 fallback to point the member directory AJAX handler to their post, inject 'password reset link' into the tagline fields configuration, and leak live password reset URLs for all users in the member directory response, including administrators.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
The Ultimate Member – User Profile