WP User Profiles <= 2.6.2 - Authenticated (Subscriber+) Privilege Escalation
Strategic Overview
Vulnerability Overview
The WP User Profiles plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their privileges to that of an administrator.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C