What is CVE-2019-10270?

CVE-2019-10270 is a high-severity vulnerability in Ultimatemember Ultimate_member, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 8.8/10. Published 2019-06-21.

How severe is CVE-2019-10270?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2019-10270 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Ultimatemember Ultimate_member

CVE-2019-10270

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset…

EPSS: 0.012 (65.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Ultimatemember Ultimate_member
N/a — versions n/a

Weakness classification (CWE)

CWE-640 — Weak Password Recovery Mechanism for Forgotten Password

Public proof-of-concept exploits

20142995/nuclei-templates

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-10270?: CVE-2019-10270 is a high-severity vulnerability in Ultimatemember Ultimate_member, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 8.8/10. Published 2019-06-21.
How severe is CVE-2019-10270?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2019-10270 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.