Advanced Form Integration Connect Forms To 300 Apps
Monthly
Unauthenticated password change against arbitrary WordPress accounts - including Administrator accounts - is possible through the Advanced Form Integration - Connect Forms to 300+ Apps plugin for WordPress in all versions up to and including 2.9.0, letting an attacker submit a public Contact Form 7 form carrying a victim's email address, the field key user_pass, and an attacker-chosen password value. The adfoin_ultimatememberac_send_data handler resolves the target user from the attacker-supplied email and forwards the attacker-controlled key/value pair directly to UM()->user()->update_profile() in the 'account' context, which deliberately bypasses Ultimate Member's banned-key validation and performs no sender identity verification, ownership check, capability check, current-password reauthentication, or sensitive-key restriction (CWE-287). The decisive gate is configuration, not attacker skill: an administrator must already have mapped public form inputs to the Ultimate Member 'Update Profile Field' action, which is why the assessed vector carries AC:H despite PR:N; no public exploit code has been identified at time of analysis.
Unauthenticated password change against arbitrary WordPress accounts - including Administrator accounts - is possible through the Advanced Form Integration - Connect Forms to 300+ Apps plugin for WordPress in all versions up to and including 2.9.0, letting an attacker submit a public Contact Form 7 form carrying a victim's email address, the field key user_pass, and an attacker-chosen password value. The adfoin_ultimatememberac_send_data handler resolves the target user from the attacker-supplied email and forwards the attacker-controlled key/value pair directly to UM()->user()->update_profile() in the 'account' context, which deliberately bypasses Ultimate Member's banned-key validation and performs no sender identity verification, ownership check, capability check, current-password reauthentication, or sensitive-key restriction (CWE-287). The decisive gate is configuration, not attacker skill: an administrator must already have mapped public form inputs to the Ultimate Member 'Update Profile Field' action, which is why the assessed vector carries AC:H despite PR:N; no public exploit code has been identified at time of analysis.