Authorization Bypass Vulnerability in Ultimate Member Plugin by Ultimate Member

CVE-2026-96451

What is CVE-2026-96451?

A vulnerability exists in the Ultimate Member plugin which allows attackers to bypass authorization controls via user-controlled keys. This flaw can lead to privilege escalation, enabling unauthorized access to user accounts and sensitive information. The affected versions range from n/a to 2.13.1, potentially impacting a wide range of WordPress setups that utilize this plugin. It is crucial for users and administrators to apply security patches and update to secure versions to mitigate risks associated with this vulnerability.

References