Ultimate Member CVE-2026-19423

Exploitation requires the Ultimate Member plugin (versions 2.6.7 through 2.12.x) to be installed and active with user registration enabled through its own registration forms. The specific triggering precondition is that the plugin must fail to resolve the set of roles permitted by the targeted profile form - this is the configuration state that activates the insecure fallback. This condition may arise from missing, empty, or misconfigured role allow-lists in the form definition. No authentication is required (PR:N). The attack is limited to WordPress sites using Ultimate Member's registration flow and does not affect sites where registration is disabled. The AC:H CVSS metric confirms that this precondition is not guaranteed across all installations, limiting mass automated exploitation. Successful exploitation grants administrator-equivalent WordPress access.

The CVSS 3.1 score of 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network-exploitable, unauthenticated access with full CIA impact but elevated attack complexity. The AC:H metric is the critical moderating factor: exploitation is not universally reliable across all Ultimate Member deployments and requires the specific condition where the plugin's form cannot resolve its permitted role set. The SSVC assessment of Exploitation: none conflicts with the confirmed existence of a publicly available POC - this suggests the exploit exists in proof-of-concept form but has not been observed in active exploitation campaigns, which is consistent with the AC:H complexity barrier. Technical Impact is rated 'total' by SSVC, reflecting the administrator-equivalent access that successful exploitation yields. Overall, this is a high-priority patch target for any site running the plugin, but the AC:H and non-automatable SSVC flags suggest mass exploitation is not imminent - targeted exploitation of sites meeting the specific configuration precondition is the realistic threat model. No EPSS score was provided in the input data.

An attacker identifies a WordPress site running an unpatched Ultimate Member plugin (≤2.12.x) where registration is open. They submit a crafted registration request with the role field set to 'administrator'. If the plugin encounters a state where it cannot resolve the profile form's permitted role set, it validates 'administrator' against the site's full role registry - where it is a valid entry - and creates the account with administrator privileges. A publicly available exploit exists documenting this technique, and the attacker then logs in with their newly created administrator account to install backdoor plugins or exfiltrate data.