EUVD-2026-69864
GHSA-xj7x-35cv-vg7p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Ultimate Member site running < 2.13.0
-
DeliverySend unauthenticated GET request to profile activity endpoint
-
ExploitPlugin omits comment-approval and privacy checks
-
ExecutionReceive pending moderated comments and private profile activity
-
ImpactHarvest sensitive user-submitted content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required - any unauthenticated remote visitor can trigger the disclosure. The target site must be running the Ultimate Member plugin at a version prior to 2.13.0 and WordPress must be configured to allow public access to member profile endpoints. Practical exposure is elevated when: (a) the site uses comment moderation (pending comments contain user-submitted sensitive content), or (b) users have profiles set to private with non-public activity. Sites where all profiles are public and comment moderation is disabled have near-zero confidentiality impact despite the bug existing. Exploitation is read-only - no account takeover, code execution, or data modification is possible through this vulnerability. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) scores 5.3 - medium severity - reflecting a low-complexity, fully unauthenticated network read with limited confidentiality impact and no integrity or availability consequence. This is an accurate characterization for a read-only disclosure bug. A publicly available exploit (tagged in the WPScan advisory) lowers the effective exploitation barrier significantly, making opportunistic scanning realistic. No CISA KEV listing means active mass exploitation is not confirmed at time of analysis. EPSS data was not provided, so exploitation probability cannot be quantified. The practical risk concentrates on sites where comment moderation is actively used or where private-profile content is sensitive (e.g., internal community portals); sites without either feature have minimal exposure. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running Ultimate Member prior to 2.13.0 and sends a crafted HTTP GET request to the plugin's profile activity endpoint for any user ID. The endpoint returns the full content of comments pending moderation and activity from private profiles without any authentication or privacy validation. A publicly available proof-of-concept simplifies this to a trivial one-line request, requiring no credentials or special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.
RemediationAI
Update the Ultimate Member plugin to version 2.13.0 or later, which adds the missing comment-approval and profile-privacy checks to the activity retrieval path. The patch is available from the WordPress plugin repository and the WPScan advisory confirms the fix version (https://wpscan.com/vulnerability/c840b8fc-3185-4eb9-a33c-1be4b0d2a6b5/). If an immediate upgrade is not possible, as a compensating control administrators should disable the profile activity feed feature within the plugin's settings, or restrict access to member profile pages to authenticated users only via a firewall rule or WordPress capability check - doing so eliminates the unauthenticated access path but may break publicly visible member directories.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ultimate Member is a widely-used WordPress membership and user-profile plugin (200k+ active installs). The vulnerability resides in the plugin's profile activity feed retrieval logic, which queries and returns comment data without applying WordPress's native comment-approval status check or the plugin's own profile-privacy gate. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause: the access-control predicate is simply absent from the data-fetch path. Affected CPE is cpe:2.3:a:unknown:ultimate_member:*:*:*:*:*:*:*:* covering all versions prior to 2.13.0. The NVD CPE vendor field is recorded as 'unknown'; the correct publisher slug is 'ultimatemember'.
Know when Ultimate Member gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network-accessible read of partial comment/profile data; no write or availability impact, no scope change, low confidentiality loss only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ultimate Member
View allThe Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary c
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
Stored cross-site scripting in the Ultimate Member plugin for WordPress (all versions before 2.13.1) lets unauthenticate
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated high severity (
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress a
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows una
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registra
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level us
WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers
Exploit-DB