Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, d1315e83e3a1194e7de0bcadf6b9ee46041e4b4f

CVE, Research URL: d1315e83e3a1194e7de0bcadf6b9ee46041e4b4f
Home page URL: Security reports for Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Application: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Published on: Dec 06, 2016
Research Description: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.76 Ultimate Member <= 1.3.75 - Missing Authorization to Password Reset The Ultimate Member plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 1.3.75. This makes it possible for unauthenticated attackers to change the passwords of any user within the vulnerabilities scope.
Affected versions: max 1.3.76.
Status: vulnerable

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &amp; Membership Plugin, d1315e83e3a1194e7de0bcadf6b9ee46041e4b4f