Security Advisory

CVE-2020-36156

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2021-01-04 17:22:25

Last updated 2024-08-04 17:23:09

Assigner mitre

CVSS score 9.9

State PUBLISHED

Description

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.

← Browse all CVEs View on cve.org ↗