Ultimate Member CVE-2026-12251

Exploitation requires three concurrent site-specific conditions: (1) a custom WordPress user role must exist on the target site that carries administrator-level capabilities (e.g., manage_options, activate_plugins, or equivalent); (2) Ultimate Member must have a role-selection field present on at least one published registration form; and (3) the plugin's post-registration safeguard against elevated accounts must be disabled - which is the default state. The CVSS PR:N vector confirms no authentication is required from the attacker. What limits exploitation is the configuration dependency: sites that have not created admin-capable custom roles, or whose registration forms do not expose a role-selection field, are not exploitable regardless of plugin version. The attack cannot be fully automated (SSVC: Automatable no) because the attacker must identify a qualifying role from the form's exposed options before submitting registration.

The NVD CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) captures the tension well: the attack is network-reachable and unauthenticated, but AC:H reflects that exploitation depends on non-default site configuration (a custom role with admin caps must exist and a role-selection field must appear on a published registration form). EPSS at 0.14% (4th percentile) is notably low despite a public PoC, suggesting the configuration prerequisites are constraining observed exploitation attempts - consistent with SSVC's 'Automatable: no' and 'Exploitation: none' ratings. However, SSVC also rates Technical Impact as 'total', correctly noting that if conditions are met, the consequence is full WordPress site compromise. The POC exists but KEV absence means no confirmed mass exploitation. Priority should be high for any organization running Ultimate Member with custom roles bearing elevated capabilities; low-priority for sites without role-selection fields on registration forms. The divergence between EPSS and SSVC technical impact is notable and not conflicting - it reflects conditional rather than universal risk.

An attacker visits a WordPress site running a vulnerable Ultimate Member registration form that includes a role-selection dropdown. The attacker inspects the form options, identifies a custom role bearing administrator-level WordPress capabilities (such as manage_options or activate_plugins), selects it, and submits a valid registration. Because the plugin does not filter admin-capable roles from the dropdown and the post-registration safeguard is off by default, the account activates immediately with full WordPress administrator privileges. The attacker then logs in and has unrestricted access to the site's admin dashboard, content, user database, and installed plugins. A publicly available proof-of-concept is referenced via WPScan.