CVE-2020-36156

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role e.g., Administrator during a profile...

CVE-2020-36156: Improper Privilege Management

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role e.g., Administrator during a profile...

PT-2021-11937

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin versions prior to 2.1.12 Description: An issue allows authenticated privilege escalation via profile update. Any user with access to the profile.php page can supply the parameter um-role with a value set to any role, su...