Ultimate Member Hack
-
Hi
This morning a new member registered and somehow managed to assign wp_capabilities of “administrator”
Pretty serious stuff, eh?
Found this article from just 3 days ago which echoes my concernhttps://securityaffairs.co/wordpress/110717/hacking/wordpress-ultimate-member-flaws.html
Pretty sure this is what happened to one of my sites
I am using your plugin on at least 4 sites
Has this issue been looked into yet?
Ross
-
The last update addressed that issue I believe.
Edit: Here is a better article explaining the actions taken and confirming the vulnerability has been addressed https://www.wordfence.com/blog/2020/11/critical-privilege-escalation-vulnerabilities-affect-100k-sites-using-ultimate-member-plugin/.
The topic ‘Ultimate Member Hack’ is closed to new replies.
