CVE-2026-7761

Name of the Vulnerable Software and Affected Versions Ultimate Member versions prior to 2.11.5

Description An account takeover is possible through the disclosure of password reset links. This issue stems from a chain of three logic bugs: an MD5 hash fallback in the get directory by hash() function that allows any post to be used as a member directory, a parsing logic flaw in the post data() function using strstr() that bypasses protected meta key restrictions by placing um anywhere in the meta key name, and missing field name validation in the build user card data() function that allows arbitrary field names, such as password reset link, to be passed to um filtered value(). Authenticated attackers with Contributor-level access or higher can exploit this by creating a malicious post via XMLRPC with crafted meta fields to point the member directory AJAX handler to their post and inject password reset link into the tagline fields configuration, resulting in the leak of live password reset URLs for all users, including administrators.

Recommendations Update to a version newer than 2.11.4.