CVE-2020-36157
Published: 04 January 2021
Summary
CVE-2020-36157 is a critical-severity an unspecified weakness vulnerability in Ultimatemember Ultimate Member. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 18.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-23735
Vulnerability details
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker…
more
could supply the role parameter with a WordPress capability (or any custom Ultimate Member role) and effectively be granted those privileges.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.