Ultimate Member <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
- ID
- WPSEC-2026-0009
- Plugin
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (ultimate-member)
- Affected
- all versions before 2.14.0
- Remediation
- Update to 2.14.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Ultimate Member on WPSec AttackSurface
- Fix released
- Published
Description
The Ultimate Member plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.13.1. The file download handler loaded the requested user and left them loaded when it rejected a request, and the account form then saved changes to whichever user was loaded. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change another user's account details, such as an administrator's email address, or delete their account. Exploitation requires a valid download nonce, which is obtainable on sites with Ultimate Member file or image fields.
References
- https://wpsec.com/vuln/WPSEC-2026-0009/
- https://plugins.svn.wordpress.org/ultimate-member/tags/2.14.0/
- https://wordpress.org/plugins/ultimate-member/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS