CVE-2020-6859

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified userid parameter. This is related to ajaximageupload and...

PT-2024-16344

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions up to, and including, 2.8.9 Description The issue allows authenticated attackers with subscriber-level access and above...

PT-2020-19271

Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.1.3 Description The issue allows remote attackers to change other users' profiles and cover photos via a modified user id parameter. This is related to ajax image upload and ajax resize image function...