Ultimate Member <= 2.0.39 – Cross-Site Request Forgery (CSRF)

Apr 3, 2019 | Security - Internet, WordPress, and otherwise

ultimate-member Ultimate Member <= 2.0.39 – Cross-Site Request Forgery (CSRF)
According to the original researcher: "A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin 2.0.38 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress 'password forget' form."
eHost managed wordpress hosting

We’re listening.

Have something to say about this article? Share it with us on Facebook, Twitter or LinkedIn:


Subscribe ToThe Weekly SEO Trade News Updates

Get the latest SEO, SEM and SMM marketing intel, tips and tricks from one of the best SEO Gurus online. 

Every Tuesday morning we send out an aggregated email listing all new posts on SEO Trade News.

Excellent! Now check your email to confirm your subscription.