EUVD-2026-51430
GHSA-x3gc-pq2r-3884
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the two required non-default preconditions (admin-capable custom role must exist plus role-selection field on published form); PR:N confirmed by unauthenticated registration path.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
Articles & Coverage 1
AnalysisAI
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registrants to self-assign a site-defined role carrying full administrator capabilities, resulting in complete site takeover. The plugin omits administrator-level roles from its registration form role-filter and ships with its post-registration elevation safeguard disabled by default, creating a two-layered failure that exposes affected sites when a custom admin-capable role exists alongside a role-selection field on a live registration form. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent site-specific conditions: (1) a custom WordPress user role must exist on the target site that carries administrator-level capabilities (e.g., manage_options, activate_plugins, or equivalent); (2) Ultimate Member must have a role-selection field present on at least one published registration form; and (3) the plugin's post-registration safeguard against elevated accounts must be disabled - which is the default state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) captures the tension well: the attack is network-reachable and unauthenticated, but AC:H reflects that exploitation depends on non-default site configuration (a custom role with admin caps must exist and a role-selection field must appear on a published registration form). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker visits a WordPress site running a vulnerable Ultimate Member registration form that includes a role-selection dropdown. The attacker inspects the form options, identifies a custom role bearing administrator-level WordPress capabilities (such as manage_options or activate_plugins), selects it, and submits a valid registration. … |
| Remediation | The primary fix is to upgrade Ultimate Member to version 2.12.1 or later, which filters administrator-level capabilities from the roles presented on registration forms and addresses the default-off safeguard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations running Ultimate Member plugin to identify instances with custom administrator-capable roles defined in registration form settings and flag any with live role-selection fields as high-risk; note that publicly available exploit code exists for this vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ultimate Member
View allThe Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary c
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated high severity (
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress a
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level us
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured o
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remo
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerabili
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today