CVE-2026-93428 in Ultimate Member Plugin
Summary
by MITRE • 10/03/2026
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The Ultimate Member plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up to and including 2.13.1. This flaw stems from an improper verification of user permissions within the plugin’s AJAX handling mechanisms, specifically targeting the wp_ajax_nopriv_um_get_members endpoint. The core issue lies in the reliance on a frontend nonce for access control without ensuring that this token is bound to a specific authenticated session or user identity. Consequently, the security mechanism intended to restrict data exposure fails entirely against unauthenticated actors who can trivially obtain and reuse these tokens.
The technical root cause involves the method by which the required authentication token, identified as um-frontend-nonce, is distributed. The plugin utilizes WordPress’s wp_localize_script function to emit this nonce directly into the client-side JavaScript environment for all visitors accessing any page where the Ultimate Member scripts are loaded. Because this script execution occurs regardless of whether a user has logged in or remains anonymous, every visitor receives a valid-looking token that satisfies the endpoint's authentication checks. The vulnerability exploits the fact that while WordPress nonces typically provide protection against Cross-Site Request Forgery by being tied to specific actions and users, Ultimate Member’s implementation treats this nonce as a sufficient gatekeeper for sensitive data retrieval without verifying the actual authorization state of the requester.
This architectural oversight allows unauthenticated attackers to bypass privacy restrictions configured within the plugin's settings. The wp_ajax_nopriv_um_get_members endpoint is designed to handle requests from non-logged-in users, but it fails to validate whether those users have permission to view specific profile fields. As a result, an attacker can query this public API and retrieve private member data that should be strictly limited. This includes field values explicitly configured as owner-only, members-only, or role-restricted, effectively nullifying the privacy controls intended by site administrators.
The operational impact of this vulnerability is significant for any website relying on Ultimate Member to manage user profiles and membership directories. Sensitive personal information belonging to registered users can be exfiltrated without authentication. This constitutes a severe breach of confidentiality and data integrity, potentially exposing email addresses, phone numbers, physical addresses, or other personally identifiable information depending on the fields enabled by the administrator. The ease of exploitation means that automated scanning tools could rapidly harvest this data from vulnerable sites across the internet, leading to potential identity theft, targeted phishing attacks, or compliance violations under regulations such as GDPR or CCPA if personal data is mishandled.
From a classification perspective, this vulnerability aligns with CWE-285, Improper Authorization, where an actor is able to access resources for which they have not been granted permission. It also maps to the MITRE ATT&CK framework technique T1078, Valid Accounts, although in this case, it specifically relates to the misuse of authentication mechanisms by unauthenticated actors due to flawed implementation logic rather than credential theft. The attack vector is classified as Network-based with Low complexity and requires no user interaction beyond visiting a page that loads the plugin's scripts, making it highly exploitable at scale.
Mitigation strategies must address both immediate remediation and long-term security hygiene. Site administrators should immediately update the Ultimate Member plugin to version 2.13.2 or later, where this authorization check has been corrected to properly validate user permissions before returning sensitive profile data. Until an update is applied, temporary workarounds may include disabling the specific AJAX endpoint if it is not actively required for public-facing functionality, although this may break legitimate features of the plugin. Additionally, implementing a Web Application Firewall with rules that monitor and restrict excessive requests to member directory endpoints can help mitigate automated scraping attempts. Regular security audits focusing on how nonces are generated and validated in custom WordPress plugins are essential to prevent similar authorization bypasses in future developments.