WordPress Plugin Vulnerabilities
Ultimate Member <= 2.10.3 - Admin+ Arbitrary Function Call
Description
The plugin is vulnerable to Arbitrary Function Calls due to the plugin not properly restricting functions that can be called. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary functions making remote code execution possible.
Affects Plugins
Fixed in 2.10.4 References
Classification
Type
RCE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No
WPVDB ID
Timeline
Publicly Published
2025-05-07 (about 1 year ago)
Added
2025-05-13 (about 1 year ago)
Last Updated
2025-05-16 (about 11 months ago)
WPScan 