CVE-2026-93428

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.13.2

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can view privacy-restricted member profile field values, including those configured as owner-only, members-only, or role-restricted. This is achieved by querying the publicly accessible 'wp ajax nopriv um get members' endpoint. The required nonce um-frontend-nonce is emitted to all unauthenticated visitors via wp localize script, which removes meaningful access control and allows anonymous visitors to satisfy authentication requirements.

Recommendations Update to version 2.13.2 or later.