CVE-2022-1209 : The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects du

The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.

Published 2022-05-10 20:15:08

Updated 2024-01-11 09:15:44

Source Wordfence

View at NVD, CVE.org

Products affected by CVE-2022-1209

Ultimatemember » Ultimate Member » For Wordpress
Versions up to, including, (<=) 2.3.1
cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-1209

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 61 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-1209

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N	6.8	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
3.5	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	2.1	1.4	Wordfence
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4	Wordfence	2024-01-11
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

References for CVE-2022-1209

https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=cve

Ultimate Member <= 2.3.1 - Arbitrary Redirect
https://github.com/ultimatemember/ultimatemember/issues/989

Security issues in URL and social fields · Issue #989 · ultimatemember/ultimatemember · GitHub
Exploit;Issue Tracking;Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1209

Vulnerability Advisories - Wordfence
Third Party Advisory
https://github.com/ultimatemember/ultimatemember/pull/990

Security issues in URL and social fields by yuriinalivaiko · Pull Request #990 · ultimatemember/ultimatemember · GitHub
Third Party Advisory
https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Open%20Redirect.md

vulnerabilities/Ultimate Member <= 2.3.1 - Open Redirect.md at main · H4de5-7/vulnerabilities · GitHub
Exploit;Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-1209

Products affected by CVE-2022-1209

Exploit prediction scoring system (EPSS) score for CVE-2022-1209

CVSS scores for CVE-2022-1209

References for CVE-2022-1209