Ultimate Member CVE-2026-62059

Requires an authenticated WordPress user holding a HIGH-privilege role (PR:H) - e.g. administrator or an equivalently trusted Ultimate Member role - able to reach the affected plugin input. The Ultimate Member plugin (<=2.13.1) must be installed and active. Exploitation is remote over the network with low complexity and no user interaction once that privilege is held, but the high authentication bar means this is realistically an insider-abuse or post-account-compromise condition rather than unauthenticated remote attack. No special non-default configuration is indicated beyond having the plugin installed.

This is a genuine but access-gated SQL injection flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, score 7.6) describes a network-reachable, low-complexity attack that nonetheless requires HIGH privileges (PR:H) - meaning the attacker must already hold an administrative or equivalently trusted role in the WordPress/Ultimate Member instance. That privilege requirement is the dominant risk-limiting factor and substantially lowers real-world urgency versus an unauthenticated SQLi. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The S:C (scope change) and C:H chosen by Patchstack reflect database-level confidentiality impact beyond the application; I lean toward S:U (the database is typically within the same security authority as the plugin), which would place my own score nearer 6.8 - a directional agreement with a scope-metric discrepancy noted. Net: a real priority for defenders who delegate admin/high-privilege roles widely, but not a drop-everything issue given the PR:H gate and absence of exploitation signals.

An attacker who already possesses a high-privilege Ultimate Member/WordPress account (or who has compromised such an account) submits crafted input to an affected plugin parameter that is concatenated into a SQL query without neutralization. Because the injection is blind, the attacker infers data through boolean/time-based responses to progressively extract user records, password hashes, and secrets from the WordPress database. No public PoC is available, and the required high privilege level makes this a post-compromise or insider-abuse scenario rather than mass opportunistic exploitation.