Unauthenticated Attackers Can Bypass Authentication and Access Any User Account, Including the Site Administrator with Default ID of 1

CVE-2020-36832

Summary

The Ultimate Membership Pro plugin for WordPress contains a vulnerability that allows unauthenticated attackers to bypass normal authentication mechanisms. This issue affects versions 7.3 through 8.6 of the plugin. By leveraging this flaw, an attacker can gain unauthorized access to any user account on a site utilizing this plugin, including accounts with administrative privileges. This presents a significant risk, as attackers could manipulate site settings or access sensitive information. Website administrators are advised to implement immediate security measures, including updating to the latest versions of the plugin and reviewing user account activity.

References