Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
wp-plugins/ultimate-member
master @ 9bb3cb3
7
Fixes
0
CVEs
HIGH
Peak severity
28.6%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
core/um-password.php: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Insecurely exposed WordPress administrative action hooks lacking capability or authorization checks allow unauthorized callers to run administrative functions or alter settings.
Auth Bypass: An incorrect length check (30 instead of 40 characters) during password reset validation allows truncated or malformed reset hashes to succeed, leading to unauthorized password modification.
SQL Injection: Lack of raw input sanitization in user administration query filtering enables SQL injection via manipulated query arguments.