CVE-2018-0587

Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.

Score

CVSS 3.0 4.3 Medium

Status

Modified - vultures@jpcert.or.jp

Published

2018-05-14

Last modified

2024-08-05

Weaknesses

CWE-434

Affected products

• Ultimate Member (Ultimate Member)
• User Profile & Membership (Ultimatemember)

References

• http://jvn.jp/en/jp/JVN28804532/index.html
• https://wordpress.org/plugins/ultimate-member/#developers
• https://wpvulndb.com/vulnerabilities/9608