What is the CVSS score of EUVD-2026-92042?

EUVD-2026-92042 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate EUVD-2026-92042?

Within 24 hours, inventory every WordPress instance running the Ultimate Member plugin and confirm which are on versions through 2.13.1, then immediately disable open front-end registration or restrict new account creation to administrator-approved workflows so the required authenticated foothold cannot be self-provisioned. Within 7 days, apply any vendor-released update the moment it is published (there is currently no vendor-released patch identified at time of analysis), and in the interim audit existing user accounts for unexpected administrator or elevated-role additions, rotate administrator credentials and salts, enforce multi-factor authentication on all privileged accounts, and deploy WAF or virtual patching rules that block manipulation of user-controlled role or privilege parameters. Within 30 days, if no vendor patch has shipped, evaluate temporarily deactivating Ultimate Member on the highest-value sites in favor of an alternative membership solution, and establish ongoing monitoring of role-change events, plugin advisories, and WordPress core and plugin update cadence so residual exposure is detected and closed as soon as a fix becomes available.

Ultimate Member EUVD-2026-92042

| CVE-2026-96451 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-10-03 Patchstack

GHSA-c87c-gj39-m74f

WordPress Authentication Bypass Privilege Escalation Ultimate Member Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Self-register low-privilege account
Delivery

Craft request with tampered user-controlled key
Exploit

Bypass authorization check (CWE-639)
Execution

Escalate to administrator role
Impact

Full control of WordPress site

Vulnerability Assessment

Weakness	CWE CWE-639 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Object-level authorization, IDOR prevention
Exploitation Conditions	Requires an authenticated account on the target WordPress site (PR:L), but because Ultimate Member provides front-end user registration, an attacker can typically obtain the needed low-privilege account via self-registration where open registration is enabled - the common deployment mode for this plugin. Exploitation then depends on the plugin exposing a user-controlled key/identifier that is not properly validated against the requester's privileges (CWE-639). Limiting factors: sites that disable open registration or restrict account creation raise the bar to a pre-existing credential; exploitation is bounded to Ultimate Member versions through 2.13.1. No special network conditions or victim interaction are required (AV:N/AC:L/UI:N).
Impact	This is a genuine priority despite thin external intelligence. The CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction - a profile that maps cleanly onto CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR) enabling privilege escalation. The practical risk driver is that Ultimate Member is a membership/registration plugin whose entire purpose is to let untrusted visitors self-register low-privilege accounts, so the PR:L prerequisite is trivially satisfiable on most real deployments - effectively collapsing the gap between 'authenticated' and 'unauthenticated' for this product class. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no confirmed active exploitation or published exploit code; the risk here is derived from the vector and product context, not from observed in-the-wild activity. Reported solely by Patchstack with no independent vendor advisory in the provided references, so affected-version and patch details should be confirmed directly with Ultimate Member before final triage.
Exploit ScenarioDerived	An attacker self-registers (or uses any existing low-privilege account) on a WordPress site running Ultimate Member ≤ 2.13.1, then manipulates a user-controlled key/identifier in a plugin request to act on or assume an account or role they do not own. By tampering with that reference, the low-privilege user escalates to administrator-level control of the site. No public exploit code was identified in the provided data, and no user interaction is required (UI:N).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 03, 2026

Privilege escalation in the Ultimate Member WordPress plugin affects all versions through 2.13.1, allowing an authenticated attacker to manipulate a user-controlled key that the plugin fails to bind to the requester's own account or privileges, thereby elevating a low-privilege account to a higher role such as administrator. The flaw requires an authenticated account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8), but because Ultimate Member supplies front-end user registration, an attacker can typically self-register on sites with open registration enabled - the common deployment mode - lowering the practical barrier to entry; sites that disable open registration require a pre-existing credential. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV), though the low attack complexity and high confidentiality, integrity, and availability impact make rapid patching a priority, with no EPSS score supplied in the available intelligence.

RemediationAI

No vendor-released patch or exact fixed version is identified in the available intelligence at time of analysis; the only reference supplied is the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-13-1-privilege-escalation-vulnerability?_s_id=cve, which should be monitored for the patched release, and administrators should update the Ultimate Member plugin through the WordPress dashboard as soon as a version above 2.13.1 becomes available. Until a fix is confirmed, apply compensating controls with an eye to their trade-offs: the highest-value mitigation is to disable or restrict open front-end registration under Ultimate Member's user-registration settings (or set registration to admin-approved/invite-only), which removes the attacker's easiest path to the required authenticated session but directly limits member acquisition and is disruptive for membership sites - where open registration must stay on, add moderation or email verification to raise the cost of mass account creation. Because the residual exposure depends on the attacker already holding a low-privilege account, aggressively restrict and audit the subscriber role's ability to edit profiles or submit parameters that write to user meta, and disable any plugin add-on or template that permits front-end role or capability changes. Deploy WAF/regex rules blocking unusual role or capability parameters in Ultimate Member AJAX and form requests, and monitor WordPress for unexpected changes to user roles or wp_capabilities metadata, alerting on any newly created administrator or elevated account - such rules are lower-risk than disabling the plugin but can be bypassed and require tuning. If registration cannot be closed and the site holds sensitive data, the most decisive option is to deactivate the Ultimate Member plugin entirely until a patched release is available, with the trade-off that all front-end membership, profile, and login functionality stops working and an alternative authentication or membership mechanism must be substituted.

Affected VersionsENISA

Ultimate Member 0 ≤2.13.1

Affected Packages

euvd ultimate_member no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Ultimate Member is a widely deployed WordPress membership and user-profile plugin that exposes front-end registration, login, profile editing, and directory features, storing user-supplied values in WordPress user meta. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an insecure-direct-object-reference style weakness in which a key, identifier, or field supplied by the user - for example a user ID, role/meta field, or profile parameter accepted by an AJAX or form-handling endpoint - is used by the plugin without verifying that the requester is entitled to read or modify the referenced object. Because the plugin does not compare the submitted key against the authenticated user's own identity or capabilities, an attacker who controls the key value can direct the plugin's privileged operation at another account or at privileged user metadata, resulting in role escalation. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the attack is network-reachable, low-complexity, needs only low privileges (an ordinary subscriber-level account, obtainable through the plugin's own self-registration flow where permitted), requires no victim interaction, and yields high impact across confidentiality, integrity, and availability within the same security scope. The supplied CPE cpe:2.3:a:ultimate_member:ultimate_member:*:*:*:*:*:*:*:* is an unversioned wildcard, so the authoritative version bound is the vendor advisory's stated range: all releases from n/a through 2.13.1. WordPress role and capability metadata is the asset ultimately at risk, and any escalation path that writes to wp_capabilities or equivalent user-meta structures is effectively a full site-compromise primitive.

Know when Ultimate Member gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network-reachable IDOR exploitable by a low-privilege self-registerable account (PR:L) with no interaction; successful role takeover yields full admin control, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

Executive ViewAI

Why It Matters

The Ultimate Member WordPress plugin, deployed on sites running versions through 2.13.1, contains a privilege escalation flaw that lets an authenticated user, including a self-registered visitor on sites with open registration, elevate their own account to administrator. Because administrative takeover of a WordPress site typically yields full control over content, user data, and any connected business systems, this represents a direct risk to site integrity and to any customer or employee data the site handles. Leadership should treat this as a priority remediation item for all externally reachable WordPress properties, particularly those with public-facing registration enabled.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable open front-end registration or require administrator approval for new accounts to remove the self-registration path; audit and revert unauthorized role changes; enforce MFA and least privilege on administrator accounts; restrict or monitor privileged account creation; deploy WAF or virtual patching rules targeting user-controlled privilege parameters; and consider temporarily deactivating the Ultimate Member plugin on high-value sites until a fix is released.

Threat Intelligence Overview

EPSS Score

0.3%

Top 79% exploitable

Prevalence

Medium

popular WordPress membership plugin, common but not on every site

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.