Description

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.

Remediation

References

CVE-2020-6859

Related Vulnerabilities

WordPress Plugin Responsive Slider-Image Slider-Slideshow for WordPress SQL Injection (2.6.8)

Django Download of Code Without Integrity Check Vulnerability (CVE-2022-36359)

WordPress Plugin WPBakery Page Builder Clipboard Cross-Site Scripting (4.5.5)

Apache Tomcat Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2026-29129)

OpenVPN AS Other Vulnerability (CVE-2006-1629)

Severity

Medium

Classification

CVE-2020-6859 CWE-639 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities