Ultimate Member CVE-2026-115968

The flaw is a PHP Object Injection via deserialization of untrusted data in Ultimate Member versions up to and including 2.13.1; per the CVSS vector (PR:N/UI:N) it is reachable by unauthenticated remote attackers with no user interaction. The exact feature, parameter or endpoint that passes untrusted input to unserialize() is not described in the available sources. The principal limiting factor is that object injection yields serious impact (RCE, file or data operations) only when a usable POP gadget chain is present in the plugin or the surrounding WordPress/PHP environment; absent a reachable gadget, impact may be reduced. Exploitation is bounded to sites running Ultimate Member at or below 2.13.1.

Signals are strongly aligned toward high priority but rest on limited sourcing. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes a network-reachable, unauthenticated, low-complexity flaw with full confidentiality, integrity and availability impact, and the vuln.today Decision label is act_now. CWE-502 plus the description's explicit 'Object Injection' indicate a PHP object-injection class issue, which in WordPress plugins commonly escalates to remote code execution - but ONLY when a usable POP gadget chain is reachable, and the available sources do not confirm that such a chain exists, so the real-world ceiling of 9.8 is plausible rather than proven. No CISA KEV listing is present (not actively exploited per available data), no EPSS score was supplied (exploitation probability cannot be quantified), and no SSVC exploitation/automatable/technical-impact breakdown was provided beyond the act_now label. The only reference is a Patchstack vulnerability-database entry, not working exploit code. Net: treat as a genuine high-priority patching item driven by the unauthenticated-network CVSS profile and act_now label, while noting that actual exploitability and impact depend on a gadget chain not confirmed in the supplied evidence.

A remote attacker submits crafted serialized data to an Ultimate Member endpoint that passes untrusted input to PHP unserialize(), instantiating attacker-chosen objects (PHP Object Injection). If a suitable gadget chain is present in the plugin or surrounding WordPress stack, this can lead to code execution, data disclosure or site compromise. No working public exploit code is identified in the supplied sources; the only reference is a Patchstack database entry, and the exact trigger is not described in the available sources.