Now officially on WordPress.org

CVE Database / CVE-2018-0588

CVE · Medium

CVE-2018-0588 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2018-0585, CVE-2018-0586, CVE-2018-0587, CVE-2018-0588, CVE-2018-0590, CVE-2018-20965, CVE-2018-0589 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 5.4 < 2.0.4 2.0.4 2018-05-10 —

CVE-2018-0585, CVE-2018-0586, CVE-2018-0587, CVE-2018-0588, CVE-2018-0590, CVE-2018-20965, CVE-2018-0589

The Ultimate Member WordPress plugin versions prior to 2.0.4 contain a directory traversal vulnerability in the AJAX function that allows attackers to access files outside intended directories. This flaw, identified as CVE-2018-0588, is one of six security issues affecting the plugin, which also include cross-site scripting, file upload, shortcode-based traversal, and access control bypass vulnerabilities. The vulnerability was reported to IPA and coordinated through JPCERT/CC with the plugin developer.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings