Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, 7a13b97c177280eff3d504b4908bdefb17b23490

CVE, Research URL: 7a13b97c177280eff3d504b4908bdefb17b23490
Home page URL: Security reports for Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Application: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Published on: Mar 10, 2015
Research Description: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.0.84 Ultimate Member < 1.0.84 - Authorization Bypass to Arbitrary File Upload/Delete The Ultimate Member plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ultimatemember_remove_file() function in versions up to, and including, 1.0.83. This makes it possible for unauthenticated attackers to delete or upload arbitrary files.
Affected versions: max 1.0.84.
Status: vulnerable

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &amp; Membership Plugin, 7a13b97c177280eff3d504b4908bdefb17b23490