CVEvulnerability
CVE-2022-1209
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-05-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-601
Description
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.
Affected configurations
• ultimatemember ultimate member (<= 2.3.1)
Related
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Open%20Redirect.md Exploit, Third Party Advisory
- https://github.com/ultimatemember/ultimatemember/issues/989 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/ultimatemember/ultimatemember/pull/990 Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=cve www.wordfence.com
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1209 Third Party Advisory
- https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Open%20Redirect.md Exploit, Third Party Advisory
- https://github.com/ultimatemember/ultimatemember/issues/989 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/ultimatemember/ultimatemember/pull/990 Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=cve www.wordfence.com
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1209 Third Party Advisory