Exposed Comment Activity in Ultimate Member Plugin for WordPress
CVE-2026-19251

Currently unrated

Key Information:

Vendor

WordPress
Status
Ultimate Member
Vendor
CVE Published:
2 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-19251?

The Ultimate Member plugin for WordPress prior to version 2.13.0 has a security flaw that allows unauthenticated users to access and view comments that are still awaiting moderation. This occurs because the plugin fails to verify whether a comment has been approved or whether the associated profile is set to private. Consequently, sensitive content associated with user activity can be disclosed to unauthorized visitors, potentially compromising user privacy and the integrity of moderated discussions.

Affected Version(s)

Ultimate Member 0 < 2.13.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-19251 - Proof of Concept

References

https://wpscan.com/vulnerability/c840b8fc-3185-4eb9-a33c-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alessandro Greco aka Aleff
Giovambattista Ianni (University of Calabria - UNICAL)
WPScan
.