What is the CVSS score of CVE-2026-7761?

CVE-2026-7761 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Ultimate Member are affected by CVE-2026-7761?

Ultimate Member WordPress plugin versions 2.11.4 and earlier enables any contributor-level user to extract valid administrator password reset links, leading to account takeover and full site…

How to fix or mitigate CVE-2026-7761?

24 hours: Identify all WordPress sites running Ultimate Member plugin ≤2.11.4; enumerate active contributor accounts; note that no public exploit code has been identified to date. 7 days: Disable the member directory subsystem or revoke all contributor access; implement real-time alerting on password resets and administrator account modifications. 30 days: Establish vendor contact for patch status; prepare migration plan to alternative membership plugins if patch timeline is unacceptable.

Ultimate Member CVE-2026-7761

EUVD-2026-38714 HIGH

Missing Authorization (CWE-862)

2026-06-24 Wordfence

GHSA-qqfq-fg56-qv34

Authentication Bypass WordPress Ultimate Member User Profile Registration Login Member Directory Content Restriction Membership Plugin

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable AJAX/XMLRPC (AV:N), scriptable chain (AC:L), requires Contributor account (PR:L), no victim interaction (UI:N), and leaked reset links yield admin takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 08:00 vuln.today

CVE Published

Jun 24, 2026 - 06:49 cve.org

HIGH 8.8

DescriptionCVE.org

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: (1) an MD5 hash fallback in get_directory_by_hash() that allows any post to be used as a member directory by computing SUBSTRING(MD5(post_id), 11, 5), (2) a strstr() parsing logic flaw in post_data() that allows bypassing WordPress's protected meta key restrictions by placing '_um_' anywhere in the meta key name rather than at the start, and (3) missing field name validation in build_user_card_data() that allows arbitrary field names including 'password_reset_link' to be passed to um_filtered_value(). This makes it possible for authenticated attackers with Contributor-level access and above to create a malicious post via XMLRPC with crafted meta fields, use the MD5 fallback to point the member directory AJAX handler to their post, inject 'password_reset_link' into the tagline_fields configuration, and leak live password reset URLs for all users in the member directory response, including administrators.

Articles & Coverage 1

News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Account takeover in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) allows Contributor-level authenticated users to harvest live password reset links for any account, including administrators, by chaining three logic bugs in the member directory subsystem. The flaw enables full site compromise because reset URLs can be used to set new administrator passwords. No public exploit identified at time of analysis, though Wordfence has published detailed technical write-ups that significantly lower the bar for weaponization.

Technical ContextAI

Ultimate Member is a widely deployed WordPress plugin providing user profiles, registration, login, member directories, content restriction, and membership features. The root cause is a CWE-862 Missing Authorization failure realized as three interacting logic flaws: get_directory_by_hash() in class-member-directory.php falls back to SUBSTRING(MD5(post_id), 11, 5) and treats arbitrary posts as legitimate directories; post_data() in class-query.php uses strstr() to detect the '_um_' prefix that should mark protected meta, but strstr() matches the substring anywhere, defeating WordPress's protected_meta filtering; and build_user_card_data() in um-short-functions.php passes any field name supplied in tagline_fields straight to um_filtered_value(), with no allowlist. Combined, a low-privileged author can register an attacker-controlled post as a directory configuration object containing the synthetic field 'password_reset_link', which the directory AJAX handler then resolves per user.

RemediationAI

Upstream fix available (commit 3569970 in the plugin's trac repository); released patched version not independently confirmed from the supplied data, so administrators should install the next Ultimate Member release after 2.11.4 published via the WordPress.org plugin repository and verify the version exceeds 2.11.4. Until a tagged release is applied, compensating controls include disabling new Contributor-or-higher registrations and auditing existing Contributor accounts (which removes the legitimate self-service workflow the plugin enables), disabling XMLRPC at the web server or with a security plugin (this breaks Jetpack, mobile apps, and remote publishing tools), and temporarily disabling the Ultimate Member member directory AJAX endpoint or the plugin itself if member directories are not business-critical. Refer to https://plugins.trac.wordpress.org/changeset/3569970/ for the upstream patch and https://www.wordfence.com/threat-intel/vulnerabilities/id/9aff7b03-4f03-434c-be87-b10ceeb4e625 for the vendor advisory.