How severe is CVE-2019-10271?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2019-10271 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Ultimatemember Ultimate Member

CVE-2019-10271

An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.

EPSS: 0.009 (54.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Ultimatemember Ultimate_member
N/a — versions n/a

Public proof-of-concept exploits

20142995/nuclei-templates

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-10271?: CVE-2019-10271 is a medium-severity vulnerability in Ultimatemember Ultimate Member. CVSS score: 4.3/10. Published 2019-06-24.
How severe is CVE-2019-10271?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2019-10271 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.