PT-2024-10842 · WordPress · Ultimate Membership Pro

Noman Riffat · Published 2024-10-15 · Updated 2024-10-21 · CVE-2020-36832

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ultimate Membership Pro plugin for WordPress versions 7.3 through 8.6

Description The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user ID.

Recommendations For versions 7.3 through 8.6, update to a version that is not affected by this issue to prevent Authentication Bypass attacks. As a temporary workaround, consider restricting access to sensitive areas of the site to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-36832

Affected Products

Ultimate Membership Pro

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2020-36832 · Security Note
• https://twitter.com/transilienceai/status/1846962858917269882 · Twitter Post
• https://twitter.com/transilienceai/status/1847688143421546604 · Twitter Post
• https://wpscan.com/vulnerability/9811025e-ab17-4255-aaaf-4f0306f5d281 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a5341bbd-55bd-41ad-b5d1-d6b56c141277?source=cve · Note
• https://twitter.com/CVEnew/status/1846444815275155466 · Twitter Post
• https://twitter.com/transilienceai/status/1847326396206444577 · Twitter Post
• https://twitter.com/transilienceai/status/1847326405899473380 · Twitter Post
• https://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253 · Note
• https://twitter.com/transilienceai/status/1847688137243349491 · Twitter Post
• https://twitter.com/transilienceai/status/1846962871089221722 · Twitter Post
• https://twitter.com/CveFindCom/status/1846447034313683200 · Twitter Post
• https://twitter.com/cracbot/status/1848242880634306953 · Twitter Post