CVE-2019-10673

The Ultimate Member plugin before version 2.0.40 contains a cross-site request forgery flaw in the user profile editing functionality that permits attackers to modify an administrator's email address without proper verification. By changing the admin email through a forged request, an attacker can then use WordPress's password reset feature to gain control of the administrator account, leading to potential unauthorized access to sensitive data and execution of malicious code.

Based on public CVE data (MITRE/NVD).