Really Simple Security logo

Log out
Get PRO

Latest

Input validation vulnerability in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.6.0

  • Severity: medium-risk
  • Status: Fixed
  • Publication: May 30, 2023

The Ultimate Member plugin for WordPress, which is used to create forms, is vulnerable to exploitation in versions 2.6.0 and before. This means that an attacker could potentially duplicate forms created with the plugin without authorization, if they manage to get a site administrator to click on a malicious link. This is due to the lack of proper validation for nonce (a unique code) when using the duplicate_form function.

Detected in:

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin fixed vulnerable versions: >= * <= 2.6.0

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.