CVE-2026-12251

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 2.12.1

Description The plugin fails to filter administrator-level capabilities from the roles available for selection on registration forms. Additionally, the post-registration safeguard designed to prevent the creation of elevated accounts is disabled by default. This allows unauthenticated users to register with a site-defined role that possesses administrator capabilities, granting them full administrative access to the site, provided such a role exists and a role-selection field is active on a published registration form.

Recommendations Update Ultimate Member WordPress plugin to version 2.12.1 or later.