EUVD-2026-69864
GHSA-xj7x-35cv-vg7p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network-accessible read of partial comment/profile data; no write or availability impact, no scope change, low confidentiality loss only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.
AnalysisAI
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - any unauthenticated remote visitor can trigger the disclosure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) scores 5.3 - medium severity - reflecting a low-complexity, fully unauthenticated network read with limited confidentiality impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Ultimate Member plugin to version 2.13.0 or later, which adds the missing comment-approval and profile-privacy checks to the activity retrieval path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ultimate Member
View allThe Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary c
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated high severity (
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress a
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows una
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registra
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level us
WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured o
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today