CVE-2019-10270

CVE-2019-10270 describes an arbitrary password reset vulnerability in the Ultimate Member plugin 2.39 for WordPress. This flaw allows an attacker to reset any user's password, including administrators, by manipulating the user_id parameter during a password modification request, requiring only knowledge of the target user's publicly available user_id. Rated 8.8 HIGH, this vulnerability has a low attack complexity and can lead to full account compromise and privilege escalation. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the potential impact remains significant.