Now officially on WordPress.org

CVE Database / CVE-2024-8520

CVE · Medium

CVE-2024-8520 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.7

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-8520 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.7 Cross-Site Request Forgery (CSRF) Medium 4.3 < 2.8.7 2.8.7 2024-10-03 —

CVE-2024-8520

The Ultimate Member plugin for WordPress contains a security flaw in versions up to 2.8.6, which allows malicious individuals to manipulate user membership levels without proper authorization. This vulnerability arises from inadequate verification of administrative actions triggered by the admin_init or user_action_hook functions. As a result, an attacker can potentially deceive an administrator into executing a specific action, thereby altering a user's membership status.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings