CVE-2019-10673 Cross-site request forgery in n/a
Attackers can exploit CSRF in the Ultimate Member plugin to change admin email, reset password, and gain administrative access for code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-10673?
CVE-2019-10673 is a high-severity vulnerability in n/a, published on 3 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile, and then the attacker is able to reset the administrator password using the WordPress "password forget" form.
Weakness: CWE-352
Which versions are affected by CVE-2019-10673?
It affects 1 product.
Products include Ultimatemember Ultimate Member.
How do I fix CVE-2019-10673?
No fix has been published for CVE-2019-10673 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-10673 being exploited?
There is no known exploitation of CVE-2019-10673 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-36155 Privilege escalation in n/a
- CVE-2020-36157 Privilege escalation in n/a
- CVE-2020-36156 Privilege escalation in n/a
- CVE-2024-1071 SQL injection in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- CVE-2023-3460 Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
Sources
Also known as GHSA-49jv-pgjv-gxxh.