CVE-2019-10673

HIGH

Ultimate Member < 2.0.40 - Authenticated Cross-Site Request Forgery in Profile Edit Form

Title source: llm
STIX 2.1

Description

A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9250

Scores

CVSS v3 8.8
EPSS 0.0182
EPSS Percentile 76.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
ultimatemember/ultimate_member < 2.0.40
Published Apr 03, 2019
Tracked Since Feb 18, 2026