Description
WordPress Plugin User Meta Manager is prone to multiple vulnerabilities, including privilege escalation and SQL injection vulnerabilities. Exploiting these issues could allow an attacker to bypass the expected capabilities check and perform otherwise restricted actions such as modify the meta information of any registered user, or to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin User Meta Manager version 3.4.6 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.4.8 or latest
References
https://www.exploit-db.com/exploits/39410/
https://www.exploit-db.com/exploits/39411/
http://seclists.org/bugtraq/2016/Feb/34
Related Vulnerabilities
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-2603)
Claroline Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-3262)
Java Unspesificed Vulnerability (CVE-2019-2426)
Joomla! Core 1.5.x Information Disclosure (1.5.0 - 1.5.11)
WordPress Plugin WP PHP widget Information Disclosure (1.0.2)