What is the CVSS score of CVE-2026-12251?

CVE-2026-12251 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ultimate Member are affected by CVE-2026-12251?

The Ultimate Member plugin for WordPress (versions before 2.12.1) contains a critical privilege escalation flaw enabling unauthenticated registrants to self-assign administrator access when custom…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12251?

Yes, a public proof-of-concept exploit is available for CVE-2026-12251. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12251?

Within 24 hours, audit all WordPress installations running Ultimate Member plugin to identify instances with custom administrator-capable roles defined in registration form settings and flag any with live role-selection fields as high-risk; note that publicly available exploit code exists for this vulnerability. Within 7 days, apply vendor patch version 2.12.1 or later to all affected instances; verify the upgrade completes successfully and test registration workflows to confirm role-assignment restrictions are enforced. Within 30 days, review administrative access logs for the preceding 60 days to detect unauthorized escalation during the exposure window, revoke any suspicious administrator accounts, and reset credentials for all existing administrators as a precaution.

Ultimate Member CVE-2026-12251

EUVD-2026-51430 HIGH

Improper Privilege Management (CWE-269)

2026-07-31 WPScan

GHSA-x3gc-pq2r-3884

WordPress Privilege Escalation Ultimate Member Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

AC:H reflects the two required non-default preconditions (admin-capable custom role must exist plus role-selection field on published form); PR:N confirmed by unauthenticated registration path.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 18:31 vuln.today

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registrants to self-assign a site-defined role carrying full administrator capabilities, resulting in complete site takeover. The plugin omits administrator-level roles from its registration form role-filter and ships with its post-registration elevation safeguard disabled by default, creating a two-layered failure that exposes affected sites when a custom admin-capable role exists alongside a role-selection field on a live registration form. A publicly available proof-of-concept is confirmed via WPScan; no public exploit identified at time of analysis as actively exploited (not in CISA KEV), and EPSS sits at 0.14%, reflecting the dependency on specific site configuration.

Technical ContextAI

Ultimate Member is a widely-used WordPress membership and user-registration plugin. The root cause is CWE-269 (Improper Privilege Management): the plugin's registration form builder fails to exclude WordPress user roles that carry administrator-level capabilities from the selectable role list, meaning site admins who create custom roles with elevated caps inadvertently expose them to unauthenticated registrants. A second defense, a post-registration check intended to block accounts that registered with elevated roles, exists in the plugin but is disabled by default - eliminating the compensating control. CPE cpe:2.3:a:unknown:ultimate_member:*:*:*:*:*:*:*:* covers all releases before 2.12.1. The flaw lives at the intersection of WordPress's native capability system and Ultimate Member's role-assignment logic in the registration pipeline, exploited over a standard HTTP registration POST request.

RemediationAI

The primary fix is to upgrade Ultimate Member to version 2.12.1 or later, which filters administrator-level capabilities from the roles presented on registration forms and addresses the default-off safeguard. The patch is confirmed available from the vendor per EUVD-2026-51430; see https://wpscan.com/vulnerability/dd394110-cf3c-4158-8b50-7abb8a23a2be/ for the advisory. If immediate upgrade is not possible, site administrators should apply two compensating controls: first, remove any administrator-level capabilities from all custom user roles that are offered via Ultimate Member registration forms (this eliminates the exploitable role target); second, enable the plugin's post-registration elevated-account safeguard in its settings to prevent newly registered accounts with elevated roles from activating. As an additional defensive measure, temporarily removing role-selection fields from published registration forms prevents role manipulation entirely, with the trade-off that user self-selection of role at registration is disabled.