Ultimate Member EUVD-2026-95590

The advisory does not name the exact feature, setting, or deployment mode required - the Patchstack description states only an Incorrect Privilege Assignment leading to Privilege Escalation in versions through 2.13.1, with no 'when configured with' qualifier disclosed. Limiting factors from the CVSS vector: high attack complexity (AC:H) implies non-trivial conditions such as specific timing, state, or request crafting rather than a one-shot exploit, which meaningfully constrains real-world exploitability; no user interaction is required (UI:N) and scope is unchanged (S:U). The vector lists PR:N (no authentication), but because the weakness is privilege escalation it may in practice require an existing low-privileged/registered account - verify with the vendor. Exploitation is bounded to sites running Ultimate Member at or below version 2.13.1.

Signals point to a moderate, not urgent, priority. The Patchstack/NVD CVSS base score is 5.6 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - network-reachable and nominally unauthenticated (PR:N), but high attack complexity (AC:H) and only Low impact to confidentiality, integrity, and availability temper the severity. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; absence of these signals is not proof of safety but does argue against widespread automated exploitation. Note a tension worth verifying: the CWE is Incorrect Privilege Assignment / Privilege Escalation (CWE-266), which normally presupposes an actor who already holds some account to escalate, yet the vector asserts PR:N (no privileges) - this PR:N-vs-privilege-escalation combination should be confirmed with the vendor, as it materially changes who can exploit this. No SSVC decision data was provided. Overall: a real but lower-tier fix-in-normal-cycle issue rather than an emergency, driven down by AC:H and uniformly Low impact.

A remote attacker interacting with a WordPress site running the Ultimate Member plugin (≤2.13.1) abuses an incorrect privilege-assignment flaw to obtain a role or capability higher than intended, gaining limited unauthorized read/write access. The high attack complexity (AC:H) suggests success depends on specific timing, configuration, or request crafting rather than a trivial single request. No public exploit code was identified at the time of analysis.