CVE-2020-36156

CVE-2020-36156 affects the WordPress plugin Ultimate Member (before 2.1.12). The vulnerability allows an authenticated user with wp-admin access to profile.php to supply the parameter um-role with a value (e.g., Administrator) during a profile update, escalating privileges. Documented impact is P...

CVE-2020-36156

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role e.g., Administrator during a profile...

CVE-2020-36157

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a...

CVE-2020-36157

The CVE-2020-36157 entry concerns the WordPress plugin Ultimate Member (before 2.1.12). The issue is an unauthenticated privilege escalation via the role parameter during user registration, caused by insufficient filtering that allows an attacker to supply a WordPress capability (or custom Ultima...

WordPress Security Vulnerabilities

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create membership sites or online communities. A security vulnerability...

WordPress Input Validation Error Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the Ultimate Member plugin before 2.1.12 for WordPress, which stems from...

Ultimate Member plugin before for WordPress security vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in Ultimate Member plugin before 2.1.12 for WordPress, which can be...

PT-2021-11936

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin versions prior to 2.1.12 Description: An issue allows unauthenticated privilege escalation via user meta. An attacker can supply an array parameter for sensitive metadata, such as the wp capabilities user meta that...

CVE-2020-35627

CVE-2020-35627 affects Ultimate WooCommerce Gift Cards 3.0.2. The issue is a file-upload vulnerability in the Custom GiftCard Template that enables remote code execution. By triggering the image-upload flow, an attacker can rename the image extension to PHP and execute PHP code on the server. Thi...

CVE-2020-35627

Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Once it contains the function "Custom Gift Card Template", the function of uploading a custom image is used, changing the name of the image...

CVE-2020-35135

The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF...

Cross site request forgery (csrf)

The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF...

CVE-2020-35135

The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF...

CVE-2020-35135

The CVE-2020-35135 issue affects the WordPress plugin “ultimate-category-excluder” (versions prior to 1.2). The root cause is a CSRF vulnerability in the ultimate-category-excluder.php file stemming from insufficient CSRF protections on the plugin’s options page. Affected component: plugin PHP co...

WordPress Ultimate Category Excluder plugin <= 1.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by SCA AppSec Checkmarx in WordPress Ultimate Category Excluder plugin versions = 1.1. Solution Update the WordPress Ultimate Category Excluder plugin to the latest available version at least 1.2...

Ultimate Category Excluder < 1.2 - Cross-Site Request Forgery

The plugin did not check for CSRF nonce in its options page, allowing attacker to perform CSRF attacks against logged in users...

WordPress ultimate-category-excluder plugin 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Ultimate-category-excluder Plugin...

PT-2020-17265 · WordPress · Ultimate-Category-Excluder

Name of the Vulnerable Software and Affected Versions: ultimate-category-excluder plugin versions prior to 1.2 Description: The issue allows for CSRF in the ultimate-category-excluder.php file. Recommendations: For versions prior to 1.2, update to version 1.2 or later to resolve the issue...

Ultimate Reviews < 2.1.33 - Unauthenticated PHP Object Injection

There were three occurrences in the plugin where an unauthenticated user could inject a serialized PHP object via a cookie, which could potentially lead to a PHP object injection vulnerability...

WordPress Ultimate Reviews plugin <= 2.1.32 - Insecure Deserialization vulnerability leading to unauthenticated PHP object injection

Insecure Deserialization vulnerability leading to unauthenticated PHP object injection found by Jerome Bruandet NinTechNet in WordPress Ultimate Reviews plugin versions = 2.1.32. Solution Update the WordPress Ultimate Reviews plugin to the latest available version at least 2.1.33...