| Package | Affected versions | Patched versions |
|---|---|---|
| ultimate member | < 2.1.12 | 2.1.12 |
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free