What’s Vulnerable › Vulnerabilities

CVE-2019-10673

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-03 · updated 2026-06-17
• Weakness: CWE-352

Description

A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.

Affected products

• ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P: before 2.0.40 — fixed in 2.0.40

How to fix

Upgrade to a fixed version: ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P 2.0.40. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/152315/WordPress-Ultimate-Member-2.0.38-Cross-Site-Request-Forgery.html
• https://wpvulndb.com/vulnerabilities/9250
• http://packetstormsecurity.com/files/152315/WordPress-Ultimate-Member-2.0.38-Cross-Site-Request-Forgery.html
• https://wpvulndb.com/vulnerabilities/9250

Get alerted when CVE-2019-10673 or the next vulnerability affects your stack