Authorization Bypass Vulnerability in Ultimate Member Plugin for WordPress
CVE-2026-93428
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 October 2026
What is CVE-2026-93428?
The Ultimate Member plugin for WordPress is susceptible to an authorization bypass issue, affecting all versions up to 2.13.1. This vulnerability arises from the plugin's inadequate checks to ensure that users are authorized to execute certain actions. As a result, unauthenticated attackers can gain access to privacy-restricted member profile fields, including those designated as owner-only, members-only, or role-restricted. The vulnerability is exploited through the publicly accessible wp_ajax_nopriv_um_get_members endpoint. Since the nonce ('um-frontend-nonce') is exposed to all unauthenticated visitors via wp_localize_script, it does not effectively control access, allowing any anonymous user to fulfill the endpoint's requirements and view sensitive information.
Affected Version(s)
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 0 <= 2.13.1