Ultimate Member 2.6.7 – 2.12.1 – Unauthenticated Privilege Escalation via Profile Form Role Field
WPScan published a new high-severity Ultimate Member vulnerability on August 26, 2026. Versions 2.6.7 through 2.12.1 are affected by unauthenticated privilege escalation through the profile form role field. Update to 2.13.0 immediately.
WPScan published a new high-severity Ultimate Member vulnerability on August 26, 2026. The affected plugin, Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, has 200,000+ active installations and a long history of sensitive registration and role-handling security issues.
The new issue affects Ultimate Member versions 2.6.7 through 2.12.1 and is fixed in 2.13.0. WPScan describes it as unauthenticated privilege escalation through the role field on profile forms. The vendor changelog for 2.13.0 also confirms a security fix for unauthenticated privilege escalation through the profile form role field.
Vulnerability Summary
- Plugin: Ultimate Member
- Slug:
ultimate-member - CVE: not listed by WPScan at publication time
- Severity: CVSS 8.1 high
- Attack class: unauthenticated privilege escalation
- Required access: none
- Affected versions: 2.6.7 through 2.12.1
- Fixed version: 2.13.0
- Install base: 200,000+ active installations
Technical Risk
Ultimate Member registration and profile forms can contain fields that influence account attributes. A role field must never allow an unauthenticated visitor to select or force a privileged role during registration or profile update. In the affected range, the profile-form role handling can be abused to escalate privileges without a valid account.
This class of bug is especially dangerous on membership sites because public registration is often enabled by design. A vulnerable configuration may turn a normal signup path into administrator or elevated-role creation. Even if the site does not expose obvious registration links, cached pages, shortcodes, or embedded Ultimate Member forms should be reviewed.
Immediate Remediation
- Update Ultimate Member to 2.13.0 or newer immediately.
- Flush cached and minified JS/CSS assets after the upgrade, as the vendor changelog requires.
- Review Ultimate Member registration and profile forms for role-related fields.
- Confirm that new users default to a safe low-privilege role such as Subscriber.
- Review administrator, editor, shop manager, and custom privileged users created recently.
- Force logout and rotate credentials if an unexpected privileged account is found.
WP-CLI Verification
wp plugin get ultimate-member --fields=name,version,status
wp plugin update ultimate-member
wp plugin get ultimate-member --field=versionReview Ultimate Member forms and role-related metadata. Treat this as a configuration audit, not proof of exploitation.
wp post list --post_type=um_form --post_status=any --fields=ID,post_title,post_status,post_modified
wp db query "SELECT p.ID,p.post_title,pm.meta_key,LEFT(pm.meta_value,200) AS meta_sample FROM {prefix}posts p JOIN {prefix}postmeta pm ON pm.post_id=p.ID WHERE p.post_type='um_form' AND (pm.meta_key LIKE '%role%' OR pm.meta_value LIKE '%role%') LIMIT 50;"Check for newly created or recently modified privileged users after patching.
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp db query "SELECT u.ID,u.user_login,u.user_email,u.user_registered FROM {prefix}users u JOIN {prefix}usermeta m ON m.user_id=u.ID WHERE m.meta_key='{prefix}capabilities' AND m.meta_value REGEXP 'administrator|editor|shop_manager' ORDER BY u.user_registered DESC LIMIT 50;"Temporary Mitigation
The permanent fix is Ultimate Member 2.13.0 or newer. If you cannot patch immediately, disable public registration, remove any role field from public Ultimate Member forms, and restrict access to registration/profile forms until the update is deployed. Sites that depend on membership signup should place registration behind manual approval until the fix is confirmed.
# Emergency containment only; update the plugin as the permanent fix.
wp option update users_can_register 0
wp plugin deactivate ultimate-memberSources
