CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.9. It affects WordPress.
CVE
CVE-2020-36156
Severity
CRITICAL
CVSS
9.9
EPSS
2.03%
WordPress
Original NVD Description
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.
Related CVEs
Other vulnerabilities affecting the same vendor(s)