CVE-2026-93428
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The Ultimate Member plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.13.1. Unauthenticated attackers can view privacy-restricted member profile field values, including owner-only, members-only, or role-restricted fields, by querying the public wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint is available to all visitors.
Risk Assessment
Risk includes exposure of sensitive user profile data, potentially compromising privacy and security.
Recommendation
It is recommended to update the Ultimate Member plugin to a version newer than 2.13.1 and implement additional access controls.
Other vulnerabilities in Ultimate Member
See all- CVE-2026-62059High
The Ultimate Member WordPress plugin is vulnerable to SQL Injection (Blind SQL Injection) due to improper neutralization of special elements in SQL commands. The issue affects versions from n/a through 2.13.1.
- CVE-2026-96539Medium
The Ultimate Member plugin for WordPress in versions up to and including 2.13.1 contains an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation. The issue affects all versions from n/a through 2.13.1.
- CVE-2026-96451High
Authorization bypass through user-controlled key vulnerability in Ultimate Member up to version 2.13.1. Allows privilege escalation.
- CVE-2026-96270High
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in versions up to and including 2.13.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an administrator opens the user record in the wp-admin modal.
- CVE-2026-85680High
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
- CVE-2026-19251Medium
The Ultimate Member WordPress plugin before version 2.13.0 does not check whether a comment has been approved or whether the profile it belongs to is private before returning profile activity to unauthenticated visitors. This allows reading the content of comments still awaiting moderation.
- CVE-2026-18547Medium
The Ultimate Member plugin for WordPress up to version 2.12.1 is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute). Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-12251High
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
- CVE-2026-15290High
The Ultimate Member plugin for WordPress is vulnerable to blind SQL injection via the search parameter in all versions up to and including 2.10.1 due to insufficient escaping and lack of query preparation. This allows unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
- CVE-2026-11766High
The Ultimate Member WordPress plugin before version 2.12.0 fails to properly sanitize and escape custom textarea profile field values before outputting them on user profiles. This allows authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
Original NVD description (English source)
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS