Snynet Solution Logo
MON - SUN: 10 AM - 6 PM
+60 11 5624 8319

Blog

These WordPress plugin bugs could jeopardize hundreds of thousands of sites

Image Description

WordPress site owners currently using the Ultimate Member plugin are being urged to update to the latest version in order to patch three serious security flaws that could be exploited to launch site takeover attacks.

Ultimate Member is a popular WordPress plugin designed to help simplify the task of creating and managing user profiles which is currently installed on over 100,000 websites. The plugin enables site owners to create a user based website with WordPress with custom privileges for different users.

However, the security firm Wordfence recently disclosed three high-severity vulnerabilities in the plugin that could be exploited by an attacker to escalate their privileges as well as take over any WordPress site running versions of Ultimate Member before version 2.1.12.

All three vulnerabilities have now been patched with the release of Ultimate Member version 2.1.12 back in late October and WordPress site owners should update the plugin immediately to avoid falling victim to any potential attacks.

Privilege escalation vulnerabilities

Of the three vulnerabilities disclosed by Wordfence in its new report, two have a maximum CVSS severity rating of 10/10 while the other has a critical CVSS score of 9.8.

The two high severity vulnerabilities can be exploited for unauthenticated privilege escalation via user meta by granting admin access upon registration and user roles by selecting an admin role during registration. The critical vulnerability is a bit less severe as an attacker would need wp-admin access to a site's profile.php page to exploit though it still allows an authenticated attacker to easily elevate their privileges to admin.

Although Ultimate Member released an updated version of its plugin which patched all three vulnerabilities in October, 34.6 percent of the plugin's active users are still running outdated versions according to data from WordPress.org.

Now that all three vulnerabilities have been publicly disclosed, cybercriminals will likely try to launch attacks against WordPress sites running vulnerable versions of the plugin which is why all Ultimate Member plugin users should update their installations to the latest version as soon as possible.

Via BleepingComputer

Date

11 Nov 2020

Sources


Share


Other Blog

  • New Linux release candidate cuts thousands of lines of unnecessary code

    Upcoming RC is a good reflection of the current state of affairs of Linux kernel development.

    Read More
  • Massive Microsoft Surface Laptop 4 leak could leave AMD fans disappointed

    Early information has leaked regarding the upcoming Microsoft Surface Laptop 4, with arrival expected in a matter of weeks.

    Read More
  • Atos brings RingCentral's Unity Office to the UK

    Atos and RingCentral have launched Unify Office in the UK, a new unified communications-as-a-service solution.

    Read More
  • Razer is making gaming PCs for some reason, and they can come with up to an Nvidia RTX 3080

    The Tomahawk Gaming PC is finally available to pre-order following its CES debut.

    Read More

Find Out More About Us

Want to hire best people for your project? Look no further you came to the right place!

Contact Us