CVE-2026-15290
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The Ultimate Member plugin for WordPress is vulnerable to blind SQL injection via the search parameter in all versions up to and including 2.10.1 due to insufficient escaping and lack of query preparation. This allows unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
Risk Assessment
An unauthenticated attacker can steal sensitive data from the WordPress database, such as user passwords, API keys, or personal data, leading to security and privacy breaches.
Recommendation
Immediately update the Ultimate Member plugin to version 2.10.2 or later, which contains the complete fix. If updating is not possible, consider temporarily disabling the plugin.
Other vulnerabilities in Ultimate Member
See all- CVE-2026-18547Medium
The Ultimate Member plugin for WordPress up to version 2.12.1 is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute). Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-12251High
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
- CVE-2026-11766High
The Ultimate Member WordPress plugin before version 2.12.0 fails to properly sanitize and escape custom textarea profile field values before outputting them on user profiles. This allows authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
- CVE-2026-8489Medium
The Ultimate Member plugin for WordPress is vulnerable to stored XSS via the 'about_me' parameter in versions up to 2.11.4 inclusive due to insufficient input sanitization and output escaping.
- CVE-2025-15064Medium
The Ultimate Member plugin for WordPress up to version 2.11.1 is vulnerable to stored cross-site scripting (XSS) via the user description field due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits an affected page. The vulnerability is exploitable only when "HTML support for user description" is enabled in Ultimate Member settings.
Original NVD description (English source)
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind SQL Injection via the search parameter in all versions up to, and including, 2.10.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability was partially patched in version 2.9.2 when initially addressing CVE-2025-0308.