CVE-2026-19423

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 2.13.0

Description An issue exists where the plugin fails to validate role selection when it cannot resolve the set of roles permitted by a profile form. Instead of checking against the form's specific allow-list, the system validates the value against the site's registered role names. This allows unauthenticated users registering through the plugin's form to assign themselves arbitrary capabilities, potentially gaining administrator-equivalent access.

Recommendations Update Ultimate Member WordPress plugin to version 2.13.0 or later.