CVE-2020-4050

In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in...

CVE-2020-4050

In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in...

CVE-2020-4050

CVE-2020-4050 (WordPress) is a vulnerability where misusing the set-screen-option filter’s return value can enable arbitrary user meta fields to be saved. It requires an admin to install a plugin that misuses the filter, after which low-privilege users may exploit it. The issue was fixed in WordP...

WP Front End Profile <= 0.2.1 - Privilege Escalation & Stored Cross-Site Scripting (XSS)

It is possible to modify a POST request to overwrite user meta including 'wpcapabilities' and 'wpuserlevel' which results in a privilege escalation vulnerability. User input is not sanitised or escaped on output resulting in a stored XSS vulnerability. Timeline: 2016-09-12: Vulnerability found...

WordPress User Meta Manager Plugin Information Disclosure Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An information disclosure vulnerability exists in the WordPress User Meta Manager plugin version 3.4.6, which allows attacker...

WordPress User Meta Manager 3.4.6 Information Disclosure

Exploit Title: WordPress User Meta Manager Plugin Information Disclosure Discovery Date: 2015-12-28 Public Disclosure Date: 2016-02-01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/ Software Link:...

WordPress Plugin User Meta Manager 3.4.6 - Information Disclosure

WordPress Plugin User Meta Manager 3.4.6 - Information Disclosure Exploit Title: WordPress User Meta Manager Plugin Information Disclosure Discovery Date: 2015-12-28 Public Disclosure Date: 2016-02-01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage:...

WordPress User Meta Manager 3.4.6 Plugin - Information Disclosure

Exploit for php platform in category web applications Exploit Title: WordPress User Meta Manager Plugin Information Disclosure Discovery Date: 2015-12-28 Public Disclosure Date: 2016-02-01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage:...

WordPress User Meta Manager Plugin 3.4.6 - Information Disclosure

Because of this vulnerability, any user, who is registered, can perform many AJAX requests and in that way get all contents of "usermeta" DB table. Solution Upgrade to version 3.4.8...

WordPress Plugin User Meta Manager 3.4.6 - Information Disclosure

Exploit Title: WordPress User Meta Manager Plugin Information Disclosure Discovery Date: 2015-12-28 Public Disclosure Date: 2016-02-01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/ Software Link:...

WordPress User Meta Manager 3.4.6 Blind SQL Injection

Exploit Title: WordPress User Meta Manager Plugin Blind SQLI Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/ Software Link:...

WordPress User Meta Manager 3.4.6 Privilege Escalation

Exploit Title: WordPress User Meta Manager Plugin Privilege Escalation Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/ Software Link:...

WordPress Plugin User Meta Manager 3.4.6 - Blind SQL Injection

WordPress Plugin User Meta Manager 3.4.6 - Blind SQL Injection Exploit Title: WordPress User Meta Manager Plugin Blind SQLI Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage:...

WordPress Plugin User Meta Manager 3.4.6 - Blind SQL Injection

Exploit Title: WordPress User Meta Manager Plugin Blind SQLI Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/ Software Link:...

WordPress User Meta Manager Plugin 3.4.6 - Blind SQL Injection

Because of this vulnerability, arbitrary MySQL commands can be passed to "ummuser" GET parameter by a registered user. Solution Update the plugin...

WordPress User Meta Manager 3.4.6 Plugin - Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: WordPress User Meta Manager Plugin Blind SQLI Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/...

WordPress User Meta Manager 3.4.6 Plugin - Privilege Escalation

Exploit for php platform in category web applications Exploit Title: WordPress User Meta Manager Plugin Privilege Escalation Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage:...

WordPress Plugin User Meta Manager 3.4.6 - Privilege Escalation

WordPress Plugin User Meta Manager 3.4.6 - Privilege Escalation Exploit Title: WordPress User Meta Manager Plugin Privilege Escalation Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage:...

WordPress User Meta Manager Plugin 3.4.6 - Privilege Escalation

Because of this vulnerability, a registered user can modify the meta information. Solution Update the plugin...

WordPress Plugin User Meta Manager 3.4.6 - Privilege Escalation

Exploit Title: WordPress User Meta Manager Plugin Privilege Escalation Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/ Software Link:...