CVE-2018-10233

Ultimate Member <= 2.0.6 - Multiple Cross-Site Request Forgery Issues

highCross-Site Request Forgery (CSRF)

8.8

CVSS Score

8.8

CVSS Score

high

Severity

2.0.7

Patched in

2101d

Time to patch

Description

The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

High

Confidentiality

High

Integrity

High

Availability

Technical Details

Affected versions<2.0.7

PublishedApril 23, 2018

Last updatedJanuary 22, 2024

Affected pluginultimate-member

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/9742a4d0-34b0-4f7f-aa2b-a6f7cb6aacd4?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database