An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ultimate Member Plugin | — | Update ultimate-member plugin to version 2.1.12, or a newer patched version | May 15, 2025 | Nov 9, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub