Description
WordPress Plugin Ultimate Membership Pro is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently generate an export containing PII (username, email address, IP address, User-Agent and so on), as well as generate authentication links by suppling an ID or Username. WordPress Plugin Ultimate Membership Pro version 8.6 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 8.6.1 or latest
References
Related Vulnerabilities
WordPress Plugin Ad Invalid Click Protector (AICP) Malicious Code (1.2.9)
WordPress Plugin Pinterest 'Pin It' Button Multiple Unspecified Vulnerabilities (1.3.1)
WordPress Plugin Woocommerce User Email Verification Security Bypass (3.3.0)
WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2020-11620)