VulnerabilityModified
CVE-2018-0590
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors.
MEDIUM 4.3EPSS 1.10%
Does this matter?
Lower severity and a low EPSS score (1.10%). Track it; it rarely justifies an emergency change on its own.
Description
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors.
- CVSS 3.0
- 4.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 1.10% probability · 64th percentile
- CISA KEV
- Not listed
- Affected
- ultimatemember/user profile \& membership
- Source
- vultures@jpcert.or.jp
References
- http://jvn.jp/en/jp/JVN28804532/index.htmlThird Party Advisory
- https://wordpress.org/plugins/ultimate-member/#developersRelease Notes
- https://wpvulndb.com/vulnerabilities/9608
- http://jvn.jp/en/jp/JVN28804532/index.htmlThird Party Advisory
- https://wordpress.org/plugins/ultimate-member/#developersRelease Notes
- https://wpvulndb.com/vulnerabilities/9608
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.