EUVD-2026-91881
GHSA-mx72-jqqr-rmpp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote AJAX endpoint with a publicly-leaked nonce gives AV:N/AC:L/PR:N/UI:N; impact is disclosure of restricted fields only, so C:H, I:N, A:N, scope unchanged.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values - including fields explicitly configured as owner-only, members-only, or role-restricted - by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.
AnalysisAI
Unauthenticated attackers can read privacy-restricted member profile field data in the WordPress plugin Ultimate Member (all versions up to and including 2.13.1) by calling the publicly reachable AJAX endpoint wp_ajax_nopriv_um_get_members, which fails to verify that the requester is authorized to see fields marked owner-only, members-only, or role-restricted. The endpoint's supposed protection, the 'um-frontend-nonce' token, is published to every anonymous visitor through wp_localize_script, so it provides no real access control and any anonymous visitor can satisfy the endpoint's checks; this yields a high-confidentiality, no-integrity/no-availability impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond having the Ultimate Member plugin installed and active (version ≤ 2.13.1) with its member directory / profile-field functionality in use - exploitation is remote and unauthenticated against default configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, actionable priority despite the absence of exploitation telemetry. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Ultimate Member WordPress plugin to version 2.14.0 or later, which the release notes state fixes CVE-2026-93428 by correcting field privacy when displaying User Profile fields. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running Ultimate Member up to and including 2.13.1, identify sites with owner-only, members-only, or role-restricted profile fields containing sensitive values, and either temporarily disable the plugin on high-risk sites or deploy a targeted WAF/reverse-proxy rule blocking unauthenticated requests to admin-ajax.php with action=um_get_members; also review web logs for anomalous um_get_members calls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ultimate Member User Profile Registration Login Member Directory Content Restriction Membership Plugin
View allAccount takeover in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) allows Contributor-level authenticated user
A information disclosure vulnerability in for WordPress is vulnerable to Sensitive Information Exposure in all (CVSS 8.0
Stored cross-site scripting in the Ultimate Member WordPress plugin (User Profile, Registration, Login, Member Directory
Stored Cross-Site Scripting in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) permits any subscriber-level aut
Stored Cross-Site Scripting in Ultimate Member WordPress plugin (all versions ≤ 2.12.1) allows authenticated attackers w
Stored cross-site scripting in Ultimate Member plugin versions up to 2.11.1 allows authenticated subscribers and above t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today