Kevin Wydler

**Name of the Vulnerable Software and Affected Versions** Ultimate Member versions prior to 2.11.5 **Description** An account takeover is possible through the disclosure of password reset links. This issue stems from a chain of three logic bugs: an MD5 hash fallback in the `get directory by hash()` function that allows any post to be used as a member directory, a parsing logic flaw in the `post data()` function using `strstr()` that bypasses protected meta key restrictions by placing ` um ` anywhere in the meta key name, and missing field name validation in the `build user card data()` function that allows arbitrary field names, such as `password reset link`, to be passed to `um filtered value()`. Authenticated attackers with Contributor-level access or higher can exploit this by creating a malicious post via XMLRPC with crafted meta fields to point the member directory AJAX handler to their post and inject `password reset link` into the `tagline fields` configuration, resulting in the leak of live password reset URLs for all users, including administrators. **Recommendations** Update to a version newer than 2.11.4.

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.11.2 Description The Ultimate Member plugin for WordPress is susceptible to Stored Cross-Site Scripting through the user description field. Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts into pages. This is exploitable when 'HTML support for user description' is enabled in the plugin settings. Recommendations Update The Ultimate Member plugin to version 2.11.2 or later.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress versions prior to 2.11.1 **Description** The software is susceptible to a Stored Cross-Site Scripting issue. Insufficient input sanitization and output escaping on user-supplied YouTube video URLs allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts. These scripts execute when a user accesses the profile page of the user who injected the script. The issue is related to the YouTube Video 'value' field and the `um profile field filter hook youtube video()` function. **Recommendations** Update The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress to version 2.11.1 or later.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress versions up to, and including, 2.9.2 **Description** The issue is related to second-order SQL Injection via filenames due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with access to upload files and manage filenames to append additional SQL queries into already existing queries, potentially extracting sensitive information from the database. The risk of this issue is considered minimal as it requires a user to be able to manipulate filenames to successfully exploit. **Recommendations** For versions up to, and including, 2.9.2, update to a version later than 2.9.2 to resolve the issue. As a temporary workaround, consider restricting access to file uploads and filename management to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: elFinder versions prior to 2.1.65 Description: Several WordPress plugins utilizing elFinder are susceptible to Directory Traversal, allowing unauthenticated attackers to delete arbitrary files. Exploitation requires the site owner to make an instance of the file manager accessible to users. Recommendations: Update elFinder to version 2.1.65 or later.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions up to, and including, 2.8.9 **Description** The issue allows authenticated attackers with subscriber-level access and above to update the profile pictures of other users due to a missing capability check on the `wp ajax um resize image()` and `ajax resize image()` functions. **Recommendations** For versions up to, and including, 2.8.9, update to a version that includes a fix for the missing capability check in the `wp ajax um resize image()` and `ajax resize image()` functions. As a temporary workaround, consider restricting access to the `wp ajax um resize image()` and `ajax resize image()` functions to prevent unauthorized profile picture updates.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress versions up to, and including, 2.8.4 **Description** The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the `Skype` and `Spotify` URL parameters. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.8.4, update to a version higher than 2.8.4 to resolve the issue. As a temporary workaround, consider restricting access to the `Skype` and `Spotify` URL parameters to minimize the risk of exploitation.