Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Ultimate Member plugin can let users gain admin rights

CVE-2026-96451 · published 15 days ago
Summary

The Ultimate Member plugin for WordPress, up to version 2.13.1, does not properly check who is allowed to do certain actions. As a result, a regular user could trick the system into giving themselves higher privileges, such as admin access. Update the plugin to the latest version or apply the vendor's patch as soon as possible.

What to do
  • Update ultimate member ultimate member to version 2.14.0.
Affected software
VendorProductAffected versions
ultimate member ultimate member <= 2.13.1
Fix: upgrade to 2.14.0
Original advisory text
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published3 Oct 2026
Updated15 Oct 2026
First seen3 Oct 2026
Sources
CVE-2026-96451 · NVD
CVE-2026-96451 · MITRE
Track software like this
Free during beta