Vulnerabilities / Ultimate Member / WPSEC-2026-0010
Ultimate Member <= 2.13.1 - Unauthenticated Sensitive Information Exposure via Private Profile Fields
Medium 5.3
CWE-200Fixed in 2.14.0
- ID
- WPSEC-2026-0010
- Plugin
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (ultimate-member)
- Affected
- all versions before 2.14.0
- Remediation
- Update to 2.14.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Ultimate Member on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-93428, on 2026-10-02.
Description
The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.1 due to missing field privacy checks when displaying profile header meta, social icons, bio, and member directory tagline and reveal fields. This makes it possible for unauthenticated attackers to view user profile field values that were restricted by the field privacy settings.
References
- https://wpsec.com/vuln/WPSEC-2026-0010/
- https://plugins.svn.wordpress.org/ultimate-member/tags/2.14.0/
- https://wordpress.org/plugins/ultimate-member/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS