Ultimate Member vulnerabilities
We track 7 vulnerabilities in Ultimate Member products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest Ultimate Member vulnerabilities
- 9.8 Critical severity
Ultimate Member: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
- 8.8 High severity
Ultimate Member: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
- 7.6 High severity
Ultimate Member: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
- 8.8 High severity
Ultimate Member: Improper Neutralization of Input During Web Page Generation
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated att
- 8.1 High severity
Ultimate Member: Improper Privilege Management
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own al
- 8.1 High severity
Ultimate Member: Improper Privilege Management
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing una
- 9.8 Critical severity
ForumWP: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.