CVE-2020-36832

The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user ID.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - security@wordfence.com

Published

2024-10-16

Last modified

2024-10-16

Weaknesses

CWE-287

Affected products

• Indeed Membership Pro (Wpindeed)
• Ultimate Membership Pro (Wpindeed)

References

• https://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253
• https://wpscan.com/vulnerability/9811025e-ab17-4255-aaaf-4f0306f5d281
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a5341bbd-55bd-41ad-b5d1-d6b56c141277?source=cve