PT-2024-39071 · WordPress · The Ultimate Member

Jack Taylor · Published 2024-10-03 · Updated 2024-10-08 · CVE-2024-8520

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress versions up to, and including, 2.8.6

Description: The issue is related to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the admin init or user action hook function. This allows unauthenticated attackers to modify a user's membership status via a forged request if they can trick a site administrator into performing an action, such as clicking on a link.

Recommendations: For versions up to, and including, 2.8.6, update to a version that includes the fix for the nonce validation issue in the admin init or user action hook function. As a temporary workaround, consider restricting access to the admin init and user action hook functions until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-8520

Affected Products

The Ultimate Member

References · 17

• https://github.com/ultimatemember/ultimatemember/pull/1549 · Patch
• https://osv.dev/vulnerability/CVE-2024-8520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8520 · Security Note
• https://plugins.trac.wordpress.org/changeset/3160947/ultimate-member/trunk/includes/admin/class-admin.php · Patch
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L41C4-L41C90 · Note
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L70C4-L70C84 · Note
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1948C1-L1959C6 · Note
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L146C1-L173C12 · Note
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L175C1-L178C7 · Note
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1945 · Note
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1880 · Note
• https://t.me/cvedetector/6958 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842179908149149949 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7ffddc03-d4ae-460e-972a-98804d947d09?source=cve · Note
• https://t.me/cvenotify/97543 · Telegram Post