CVE-2019-10271
Last modified
CVE-2019-10271 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. EPSS estimates a 0.86% chance of exploitation in the next 30 days.
Description
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ultimatemember | Ultimate Member | < 2.0.40 |
References
- https://cxsecurity.com/issue/WLB-2019060120Third Party Advisory
- https://cxsecurity.com/issue/WLB-2019060120Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10271?
How severe is CVE-2019-10271?
How do I fix CVE-2019-10271?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10266An issue was discovered in Ahsay Cloud Backup Suite before 8…
- CVE-2019-10267An insecure file upload and code execution issue was discove…
- CVE-2019-10268Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-10269BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a sta…9.8
- CVE-2019-1027An elevation of privilege exists in Windows Audio Service. A…7.8
- CVE-2019-10270An arbitrary password reset issue was discovered in the Ulti…8.8
- CVE-2019-10272An issue was discovered in Weaver e-cology 9.0. There is a C…
- CVE-2019-10273Information leakage vulnerability in the /mc login page in M…
- CVE-2019-10276Western Bridge Cobub Razor 0.8.0 has a file upload vulnerabi…
- CVE-2019-10277Jenkins StarTeam Plugin stores credentials unencrypted in jo…8.8
- CVE-2019-10278A cross-site request forgery vulnerability in Jenkins jenkin…
- CVE-2019-10279A missing permission check in Jenkins jenkins-reviewbot Plug…6.5
Are you affected by CVE-2019-10271?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST