EUVD-2026-67570
GHSA-g9rf-98hp-9vc3
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible registration form requires no authentication; AC:H reflects the specific plugin configuration failure state required to trigger insecure fallback validation.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.
Articles & Coverage 1
AnalysisAI
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Ultimate Member plugin (versions 2.6.7 through 2.12.x) to be installed and active with user registration enabled through its own registration forms. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network-exploitable, unauthenticated access with full CIA impact but elevated attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Ultimate Member WordPress plugin to version 2.13.0 or later, which patches the role validation logic to check submitted roles against the form's own allow-list rather than the site-wide role registry. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances running Ultimate Member versions 2.6.7 through 2.12.x; treat as critical given that publicly available exploit code exists and any internet-accessible registration form is an attack vector. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ultimate Member
View allThe Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary c
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated high severity (
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress a
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registra
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level us
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured o
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remo
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today