PT-2021-11936 · WordPress · Ultimate Member
CVSS v3.1
10
Critical
| Vector | AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N |
Name of the Vulnerable Software and Affected Versions:
Ultimate Member plugin versions prior to 2.1.12
Description:
An issue allows unauthenticated privilege escalation via user meta. An attacker can supply an array parameter for sensitive metadata, such as the
wp capabilities user meta that defines a user's role. During the registration process, submitted registration details are passed to the update profile function, and any metadata is accepted, for example, wp capabilities[administrator] for Administrator access.Recommendations:
For Ultimate Member plugin versions prior to 2.1.12, update to version 2.1.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the registration process or disabling the
update profile function until a patch is available. Avoid accepting any metadata during the registration process until the issue is resolved.Exploit
Fix
LPE
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ultimate Member