Description (CNA)
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Ultimate Member | affected 0 before 2.12.1 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.