Now officially on WordPress.org

CVE Database / CVE-2018-0589

CVE · Medium

CVE-2018-0589 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2018-0589 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 — Medium 4.3 < 2.0.4 2.0.4 2018-05-10 —

CVE-2018-0589

The Ultimate Member WordPress plugin before version 2.0.4 contains an access restriction bypass vulnerability that allows users to circumvent authorization controls on the Forms page. This flaw enables attackers to gain unauthorized access to restricted functionality that should only be available to specific user roles or permission levels. The vulnerability was discovered by Gen Sato of Mitsui Bussan Secure Directions, Inc. and coordinated through JPCERT/CC and the IPA Information Security Early Warning Partnership.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings