WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory < 2.9.21 - Unauthenticated Privilege Escalation

Description

The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.20. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privileges beyond those intended for their role.