CVE-2024-8520

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the admin_init or user_action_hook function. This makes it possible for unauthenticated attackers to modify a users membership status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1880Product
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1945Product
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1948C1-L1959C6Product
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L70C4-L70C84Product
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L146C1-L173C12Product
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L175C1-L178C7Product
• https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L41C4-L41C90Product
• https://github.com/ultimatemember/ultimatemember/pull/1549Patch
• https://plugins.trac.wordpress.org/changeset/3160947/ultimate-member/trunk/includes/admin/class-admin.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffddc03-d4ae-460e-972a-98804d947d09?source=cveThird Party Advisory

Published

Oct 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8514The Prisna GWT – Google Website Translator plugin for WordPr…7.2
• CVE-2024-8515The Themesflat Addons For Elementor plugin for WordPress is …5.4
• CVE-2024-8516The Themesflat Addons For Elementor plugin for WordPress is …4.3
• CVE-2024-8517SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a co…9.8
• CVE-2024-8518CWE-20: Improper Input Validation vulnerability exists that …3.3
• CVE-2024-8519The Ultimate Member – User Profile, Registration, Login, Mem…5.4
• CVE-2024-8521A vulnerability, which was classified as problematic, was fo…6.1
• CVE-2024-8522The LearnPress – WordPress LMS Plugin plugin for WordPress i…7.5
• CVE-2024-8523A vulnerability was found in lmxcms up to 1.4 and classified…7.2
• CVE-2024-8524A directory traversal vulnerability exists in modelscope/age…7.5
• CVE-2024-8525An unrestricted upload of file with dangerous type in Automa…10
• CVE-2024-8526A vulnerability in Automated Logic WebCTRL 7.0 could allow a…5.9