Medium severity4.3NVD Advisory· Published Nov 21, 2024· Updated Jun 17, 2026
CVE-2024-10528
CVE-2024-10528
Description
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a missing capability check on the wp_ajax_um_resize_image() and ajax_resize_image() functions in all versions up to, and including, 2.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the profile pictures of other users.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<=2.8.9+ 1 more
- (no CPE)range: <=2.8.9
- (no CPE)
- ultimatemember/Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Pluginv5Range: 0
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/changesetnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/0a9793b6-2186-46ef-b204-d8f8f154ebf3nvdThird Party Advisory
- github.com/ultimatemember/ultimatemember/blob/ab05bc570a8ba6449cd470791be1c0670eb9c203/includes/core/class-files.phpnvdProduct
- github.com/ultimatemember/ultimatemember/blob/ab05bc570a8ba6449cd470791be1c0670eb9c203/includes/core/class-files.phpnvdProduct
News mentions
0No linked articles in our index yet.