CVE-2020-36156: 
WordPress vulnerability analysis and mitigation

An issue was discovered in the Ultimate Member plugin before version 2.1.12 for WordPress (CVE-2020-36156), identified as an Authenticated Privilege Escalation via Profile Update vulnerability. The vulnerability was discovered and disclosed on November 9, 2020. The issue affected any user with wp-admin access to the profile.php page, who could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, effectively allowing privilege escalation (Wordfence, WPScan).

The vulnerability stems from the Ultimate Member plugin's functionality that allowed the creation of new roles and made it possible for users to grant secondary Ultimate Member roles during profile updates. The vulnerability has a CVSS v3.1 score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The issue is classified under CWE-269 (Improper Privilege Management) (WPScan).

The vulnerability allows authenticated users to escalate their privileges to administrator level, potentially gaining full control over the WordPress site. This could lead to unauthorized access to sensitive information, modification of site content, and complete compromise of the website's security (Wordfence).

The vulnerability is exploitable by any authenticated user with access to the wp-admin profile.php page. The exploitation involves manipulating the um-role parameter during a profile update request to escalate privileges to administrator level (WPScan).

The vulnerability was patched in Ultimate Member version 2.1.12. Site administrators are strongly advised to update to this version or later to mitigate the risk. No alternative workarounds were provided (WordPress Plugin).