CVE Database /
CVE-2020-6859
CVE · Medium
CVE-2020-6859 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2020-6859
|
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.3 |
Authorization Bypass Through User-Controlled Key |
Medium
5.3
|
< 2.1.3
|
2.1.3 |
2020-01-13 |
—
|
CVE-2020-6859
The Ultimate Member plugin versions up to 2.1.2 contained multiple insecure direct object reference flaws in its file handling code that allowed unauthenticated attackers to modify arbitrary user profile and cover photos by manipulating the user_id parameter sent to the ajax_image_upload and ajax_resize_image functions. This vulnerability enabled attackers to alter other users' account information without proper authorization checks. The issue was resolved in version 2.1.3.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings