CRITICAL🇵🇱 Wersja polska

CVE-2020-36156

CVSS 9.9v3.1pub. 2021-01-04upd. 2024-11-21

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Ultimatemember Ultimate Member

    APP
    Ultimatemember
    < 2.1.12
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2024-1071CRITICAL9.8PL ✓same product

SQL Injection w pluginie Ultimate Member dla WordPress (CVE-2024-1071)

CVE-2023-3460CRITICAL9.8PL ✓same product

Ultimate Member WordPress — tworzenie kont administratora przez gości

CVE-2020-36157CRITICAL10.0PL ✓same product

Privilege escalation bez uwierzytelnienia w pluginie Ultimate Member dla WordPress

CVE-2020-36155CRITICAL10.0PL ✓same product

Ultimate Member Plugin – Nieuwierzytelniony Privilege Escalation przez User Meta

CVE-2025-0308HIGH7.5same product

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pl...