CVE-2019-10271

Ultimate Member <= 2.0.39 - Unauthorized Profile Modification

2019-06-15 00:00
Clément CRUCHET

Strategic Overview

Status
Patched in 2.0.40
Affected Plugin
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Affected Version
<= 2.0.39
CVSS
4.3Medium
Weakness type
CWE-862 · Missing Authorization
CVE
CVE-2019-10271
View all Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities

At a glance

CVE-2019-10271 is a medium-severity Missing Authorization vulnerability in the Ultimate Member WordPress plugin, affecting versions <= 2.0.39. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). The issue is fixed in version 2.0.40; sites on affected versions should update now. Disclosed June 2019, reported by Clément CRUCHET.

Vulnerability Overview

An issue was discovered in the Ultimate Member plugin 2.0.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-862: Missing Authorization

Reaching this weakness in Ultimate Member <= 2.0.39 takes a caller who can reach the endpoint. A missing authorization check means a function is reachable by anyone who can reach the endpoint, because the code never asks whether the caller is allowed to perform the action.

Any user who can reach the endpoint gets to run an action reserved for higher-privileged roles, from reading protected data to changing settings or content. For Ultimate Member the fix is 2.0.40: builds <= 2.0.39 are affected, anything from 2.0.40 onward is not.

Remediation

Update to version 2.0.40, or a newer patched version

How does WordSec protect against this?

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Ultimate Member 2.0.40 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2019-10271https://www.wordfence.com/threat-intel/vulnerabilities/id/00b4b903-4682-458b-9681-751179460b75https://nvd.nist.gov/vuln/detail/CVE-2019-10271

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C