CVE-2024-10216

Name of the Vulnerable Software and Affected Versions The WP User Manager – User Profile Builder & Membership plugin for WordPress versions up to, and including, 2.9.11

Description The issue is related to a missing capability check on the add sidebar and remove sidebar functions. This allows authenticated attackers with Subscriber-level access and above to add or remove a Carbon Fields custom sidebar if the Carbon Fields plugin is installed.

Recommendations For versions up to, and including, 2.9.11, consider disabling the add sidebar and remove sidebar functions until a patch is available to prevent unauthorized modification of data. Restrict access to the Carbon Fields custom sidebar to minimize the risk of exploitation.