CVE-2020-36157

CVE-2020-36157 is a critical unauthenticated privilege escalation vulnerability affecting the Ultimate Member plugin for WordPress versions prior to 2.1.12. An attacker can exploit this flaw during user registration by supplying a crafted 'role' parameter, granting them elevated privileges, including WordPress capabilities or custom Ultimate Member roles. With a CVSS score of 9.8, this vulnerability poses a severe risk due to its network-based attack vector, low complexity, and potential for complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.