PT-2021-11936 · WordPress · Ultimate Member

Chloe Chamberland · Published 2021-01-04 · Updated 2025-09-18 · CVE-2020-36155

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin versions prior to 2.1.12

Description: An issue allows unauthenticated privilege escalation via user meta. An attacker can supply an array parameter for sensitive metadata, such as the wp capabilities user meta that defines a user's role. During the registration process, submitted registration details are passed to the update profile function, and any metadata is accepted, for example, wp capabilities[administrator] for Administrator access.

Recommendations: For Ultimate Member plugin versions prior to 2.1.12, update to version 2.1.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the registration process or disabling the update profile function until a patch is available. Avoid accepting any metadata during the registration process until the issue is resolved.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-36155

Affected Products

Ultimate Member

References · 7

• 🔥 https://wordfence.com/blog/2020/11/critical-privilege-escalation-vulnerabilities-affect-100k-sites-using-ultimate-member-plugin · Exploit
• 🔥 https://wpscan.com/vulnerability/cf13b0f8-5815-4d27-a276-5eff8985fc0b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36155 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36155 · Vendor Advisory
• https://t.me/cvenotify/8300 · Telegram Post
• https://wordpress.org/plugins/ultimate-member/#developers · Note
• https://twitter.com/pdnuclei_bot/status/1968616026079203616 · Twitter Post