Ultimate Member Ultimate Member vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ultimate Member Ultimate Member: 4 record(s), with affected versions and fixes.
CVE-2026-96539
Medium · 5.6
CWE-266 Oct 9, 2026
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
CVE-2026-96451
High · 8.8
CWE-639 Oct 3, 2026
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
CVE-2026-62059
High · 7.6
CWE-89 Oct 1, 2026
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
CVE-2020-37169
Medium · 5.5
CWE-98 May 13, 2026
WordPress Plugin ultimate-member 2.1.3 Local File Inclusion
WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.