WordPress (opens in new tab) site owners currently using the Ultimate Member plugin are being urged to update to the latest version in order to patch three serious security flaws that could be exploited to launch site takeover attacks.
Ultimate Member is a popular WordPress plugin (opens in new tab) designed to help simplify the task of creating and managing user profiles which is currently installed on over 100,000 websites. The plugin enables site owners to create a user based website with WordPress with custom privileges for different users.
However, the security firm Wordfence (opens in new tab) recently disclosed three high-severity vulnerabilities in the plugin that could be exploited by an attacker to escalate their privileges as well as take over any WordPress site running versions of Ultimate Member before version 2.1.12.
- We've put together a list of the best WordPress plugins (opens in new tab) around
- These are the best managed WordPress hosting (opens in new tab) providers
- Also check out our roundup of the best CMS (opens in new tab)
All three vulnerabilities have now been patched with the release of Ultimate Member version 2.1.12 (opens in new tab) back in late October and WordPress site owners should update the plugin immediately to avoid falling victim to any potential attacks.
Privilege escalation vulnerabilities
Of the three vulnerabilities disclosed by Wordfence in its new report (opens in new tab), two have a maximum CVSS severity rating of 10/10 while the other has a critical CVSS score of 9.8.
The two high severity vulnerabilities can be exploited for unauthenticated privilege escalation via user meta by granting admin access upon registration and user roles by selecting an admin role during registration. The critical vulnerability is a bit less severe as an attacker would need wp-admin access to a site's profile.php page to exploit though it still allows an authenticated attacker to easily elevate their privileges to admin.
Although Ultimate Member released an updated version of its plugin which patched all three vulnerabilities in October, 34.6 percent of the plugin's active users are still running outdated versions according to data (opens in new tab) from WordPress.org.
Now that all three vulnerabilities have been publicly disclosed, cybercriminals will likely try to launch attacks against WordPress sites running vulnerable versions of the plugin which is why all Ultimate Member plugin users should update their installations to the latest version as soon as possible.
- We've also highlighted the best WordPress hosting (opens in new tab)
Via BleepingComputer (opens in new tab)
