CVE-2019-10673

A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and…

published April 3, 2019

CVSS
—
EPSS
2%
Percentile
78.5
In the wild
Unconfirmed
What it is

A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01816 · 78.5th percentile
Published
2019-04-03T04:12Z
EPSS history
Timeline
  • 03 APR 04:12Z
    A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and…
    cvelistv5