WordPress Plugin Vulnerabilities
Ultimate Member < 2.1.7 - Unauthenticated Open Redirect
Description
The Ultimate Member WordPress plugin was vulnerable to an Unauthenticated Open Redirect vulnerability, affecting the registration and login pages where the "redirect_to" GET parameter was used.
Proof of Concept
https://www.example.com/register/?redirect_to=https://www.evil.com/
Affects Plugins
Fixed in version 2.1.7
References
Classification
Miscellaneous
Timeline
Publicly Published
2020-08-12 (about 2 years ago)
Added
2020-08-12 (about 2 years ago)
Last Updated
2020-08-13 (about 2 years ago)