CVE-2020-36156

2021-01-0418:15:13

Google

osv.dev

7.4 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.8%

JSON

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.

CPENameOperatorVersion
ultimatemembereq2.1.2
ultimatemembereq2.1.0-rc.2
ultimatemembereq2.0.56
ultimatemembereq1.3.37
ultimatemembereq1.3.81
ultimatemembereq2.0.37
ultimatemembereq2.0.31
ultimatemembereq1.3.52
ultimatemembereq1.3.75
ultimatemembereq1.3.44

Name	Operator	Version
ultimatemember	eq	2.1.2
ultimatemember	eq	2.1.0-rc.2
ultimatemember	eq	2.0.56
ultimatemember	eq	1.3.37
ultimatemember	eq	1.3.81
ultimatemember	eq	2.0.37
ultimatemember	eq	2.0.31
ultimatemember	eq	1.3.52
ultimatemember	eq	1.3.75
ultimatemember	eq	1.3.44