Vulnerability Details : CVE-2020-6859
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.
Products affected by CVE-2020-6859
- cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-6859
0.35%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 69 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-6859
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2020-6859
-
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-6859
-
https://github.com/ultimatemember/ultimatemember/commit/249682559012734a4f7d71f52609b2f301ea55b1
- fixed vulnerability with uploading cover/profile photo for other us… · ultimatemember/ultimatemember@2496825 · GitHubPatch;Third Party Advisory
-
https://github.com/ultimatemember/ultimatemember/blob/627bbb0fae81ac34c60b43f0867eadcf8e1bc523/includes/core/class-files.php#L269
ultimatemember/class-files.php at 627bbb0fae81ac34c60b43f0867eadcf8e1bc523 · ultimatemember/ultimatemember · GitHubThird Party Advisory
-
https://wordpress.org/plugins/ultimate-member/#developers
Ultimate Member – User Profile & Membership Plugin – WordPress plugin | WordPress.orgVendor Advisory
-
https://github.com/ultimatemember/ultimatemember/blob/627bbb0fae81ac34c60b43f0867eadcf8e1bc523/includes/core/class-files.php#L310
ultimatemember/class-files.php at 627bbb0fae81ac34c60b43f0867eadcf8e1bc523 · ultimatemember/ultimatemember · GitHubThird Party Advisory
-
https://wpvulndb.com/vulnerabilities/10041
Ultimate Member < 2.1.3 - Insecure Direct Object Reference (IDOR)Third Party Advisory
Jump to