Vulnerability Details CVE-2020-36157
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a WordPress capability (or any custom Ultimate Member role) and effectively be granted those privileges.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.015
EPSS Ranking 80.4%
CVSS Severity
CVSS v3 Score 10.0
CVSS v2 Score 7.5
References
- https://wordpress.org/plugins/ultimate-member/#developers
- https://wpscan.com/vulnerability/33f059c5-58e5-44b9-bb27-793c3cedef3b
- https://www.wordfence.com/blog/2020/11/critical-privilege-escalation-vulnerabilities-affect-100k-sites-using-ultimate-member-plugin/
- https://wordpress.org/plugins/ultimate-member/#developers
- https://wpscan.com/vulnerability/33f059c5-58e5-44b9-bb27-793c3cedef3b
- https://www.wordfence.com/blog/2020/11/critical-privilege-escalation-vulnerabilities-affect-100k-sites-using-ultimate-member-plugin/
Products affected by CVE-2020-36157
-
cpe:2.3:a:ultimatemember:ultimate_member:-
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.0
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.10
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.15
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.16
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.17
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.18
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.19
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.20
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.21
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.22
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.23
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.24
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.25
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.26
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.27
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.28
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.29
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.30
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.31
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.32
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.33
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.34
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.35
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.36
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.37
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.38
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.39
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.40
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.41
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.42
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.43
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.44
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.45
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.46
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.47
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.48
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.49
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.50
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.51
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.52
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.53
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.54
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.55
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.56
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.57
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.58
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.59
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.60
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.61
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.62
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.63
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.64
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.65
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.66
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.67
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.68
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.69
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.70
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.71
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.72
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.73
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.74
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.75
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.76
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.77
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.78
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.79
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.80
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.81
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.82
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.83
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.84
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.85
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.86
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.87
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.88
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.89
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.90
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.91
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.92
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.93
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.94
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.95
-
cpe:2.3:a:ultimatemember:ultimate_member:1.0.96
-
cpe:2.3:a:ultimatemember:ultimate_member:1.1.0
-
cpe:2.3:a:ultimatemember:ultimate_member:1.1.1
-
cpe:2.3:a:ultimatemember:ultimate_member:1.1.2
-
cpe:2.3:a:ultimatemember:ultimate_member:1.1.3
-
cpe:2.3:a:ultimatemember:ultimate_member:1.1.4
-
cpe:2.3:a:ultimatemember:ultimate_member:1.1.5
-
cpe:2.3:a:ultimatemember:ultimate_member:1.1.6
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.2
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.3
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.4
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.5
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.6
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.7
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.8
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.9
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.91
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.92
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.93
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.94
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.95
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.96
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.97
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.98
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.99
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.993
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.994
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.995
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.996
-
cpe:2.3:a:ultimatemember:ultimate_member:1.2.997
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.0
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.1
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.11
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.12
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.13
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.14
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.15
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.16
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.17
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.18
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.19
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.20
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.21
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.22
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.23
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.24
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.25
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.26
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.27
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.28
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.29
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.30
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.31
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.32
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.33
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.34
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.35
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.36
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.37
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.38
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.39
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.40
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.41
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.42
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.43
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.44
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.45
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.46
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.47
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.48
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.49
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.50
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.51
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.52
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.53
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.54
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.55
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.56
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.57
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.58
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.59
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.60
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.61
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.62
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.63
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.64
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.65
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.66
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.67
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.68
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.69
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.70
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.71
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.72
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.73
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.74
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.75
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.76
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.77
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.78
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.79
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.80
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.81
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.82
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.83
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.84
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.85
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.86
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.87
-
cpe:2.3:a:ultimatemember:ultimate_member:1.3.88
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.10
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.11
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.12
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.13
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.14
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.15
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.16
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.17
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.18
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.19
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.20
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.21
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.22
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.23
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.24
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.25
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.26
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.27
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.28
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.29
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.30
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.31
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.32
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.33
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.34
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.35
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.36
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.37
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.38
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.39
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.4
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.40
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.41
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.42
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.43
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.44
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.45
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.46
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.47
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.48
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.49
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.5
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.50
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.51
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.52
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.53
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.54
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.6
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.7
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.8
-
cpe:2.3:a:ultimatemember:ultimate_member:2.0.9
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.10
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.11
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.2
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.3
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.4
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.5
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.6
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.7
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.8
-
cpe:2.3:a:ultimatemember:ultimate_member:2.1.9