Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Ultimate Member plugin lets attackers change any user's photos

CVE-2019-10271 · published 7 years ago
Summary

The Ultimate Member add‑on for WordPress (version 2.39) lets a person who can send a specially crafted request replace any user's profile or cover picture, including those of administrators. This can be used to impersonate users or display inappropriate images. Apply the vendor's update or patch as soon as possible and restrict who can send upload requests.

What to do
  • Update ultimatemember ultimate_member to version 2.0.40 or later.
Affected software
VendorProductAffected versions
ultimatemember ultimate_member < 2.0.40
cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*
Original advisory text
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of an...
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published24 Jun 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-10271 · NVD
Track software like this
Free during beta