These WordPress plugin bugs could jeopardize hundreds of thousands of sites

WordPress logo
(Image credit: Pixabay)
Audio player loading…

WordPress (opens in new tab) site owners currently using the Ultimate Member plugin are being urged to update to the latest version in order to patch three serious security flaws that could be exploited to launch site takeover attacks.

Ultimate Member is a popular WordPress plugin (opens in new tab) designed to help simplify the task of creating and managing user profiles which is currently installed on over 100,000 websites. The plugin enables site owners to create a user based website with WordPress with custom privileges for different users.

However, the security firm Wordfence (opens in new tab) recently disclosed three high-severity vulnerabilities in the plugin that could be exploited by an attacker to escalate their privileges as well as take over any WordPress site running versions of Ultimate Member before version 2.1.12.

All three vulnerabilities have now been patched with the release of Ultimate Member version 2.1.12 (opens in new tab) back in late October and WordPress site owners should update the plugin immediately to avoid falling victim to any potential attacks.

Privilege escalation vulnerabilities

Of the three vulnerabilities disclosed by Wordfence in its new report (opens in new tab), two have a maximum CVSS severity rating of 10/10 while the other has a critical CVSS score of 9.8.

The two high severity vulnerabilities can be exploited for unauthenticated privilege escalation via user meta by granting admin access upon registration and user roles by selecting an admin role during registration. The critical vulnerability is a bit less severe as an attacker would need wp-admin access to a site's profile.php page to exploit though it still allows an authenticated attacker to easily elevate their privileges to admin.

Although Ultimate Member released an updated version of its plugin which patched all three vulnerabilities in October, 34.6 percent of the plugin's active users are still running outdated versions according to data (opens in new tab) from WordPress.org.

Now that all three vulnerabilities have been publicly disclosed, cybercriminals will likely try to launch attacks against WordPress sites running vulnerable versions of the plugin which is why all Ultimate Member plugin users should update their installations to the latest version as soon as possible.

Via BleepingComputer (opens in new tab)

Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.