CVE-2020-6859 : Exploit Details and Defense Strategies

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.

Understanding CVE-2020-6859

This CVE involves security vulnerabilities in the Ultimate Member plugin for WordPress that could be exploited by remote attackers.

What is CVE-2020-6859?

CVE-2020-6859 refers to multiple Insecure Direct Object Reference vulnerabilities in the Ultimate Member plugin for WordPress, allowing unauthorized users to manipulate other users' profiles and cover photos.

The Impact of CVE-2020-6859

The vulnerabilities in the Ultimate Member plugin could lead to unauthorized profile and cover photo changes by malicious actors, compromising user privacy and potentially causing reputational damage.

Technical Details of CVE-2020-6859

This section provides more in-depth technical insights into the CVE.

Vulnerability Description

The vulnerabilities exist in includes/core/class-files.php in the Ultimate Member plugin through version 2.1.2, enabling attackers to alter user profiles and cover photos through a manipulated user_id parameter.

Affected Systems and Versions

Ultimate Member plugin through version 2.1.2 for WordPress

Exploitation Mechanism

The vulnerabilities can be exploited by remote attackers who modify the user_id parameter, specifically through the ajax_image_upload and ajax_resize_image functionalities.

Mitigation and Prevention

Protecting systems from CVE-2020-6859 is crucial to maintaining security.

Immediate Steps to Take

Update the Ultimate Member plugin to the latest version to patch the vulnerabilities
Monitor user profile changes for any unauthorized modifications

Long-Term Security Practices

Regularly audit and review plugin code for security flaws
Educate users on safe practices to prevent unauthorized access

Patching and Updates

Apply security patches promptly to all plugins and software to prevent exploitation of known vulnerabilities