Ultimate Member WordPress plugin: PHP Object Injection via untrusted data

Summary

The Ultimate Member WordPress plugin up to and including version 2.13.1 deserializes untrusted data (CWE-502), which allows PHP Object Injection. According to Patchstack, the flaw can be exploited without authentication over the network. An attacker can manipulate how the website processes data and may be able to run harmful actions on the server; the actual impact depends on the PHP code available on the site and was not assessed. The CVSS score is 9.8 (critical), and NVD analysis was still pending at the time of writing.

Affected

• Ultimate Member plugin for WordPress, versions up to and including 2.13.1
• Earliest affected release: Unknown.

Fixed in

• Update to version 2.14.0 or later. The latest available release (2.14.1 according to WordPress.org) should be installed.

Workaround

• No vendor-documented workaround.
• If patching is not possible, deactivate the plugin until it has been updated.

Exploitation

• Not known to be exploited (OffSeq, VulDB).
• No public exploit available according to VulDB; the search for public proof of concept was limited.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Patchstack expects the vulnerability to be exploited and notes that such flaws are used in mass-exploit campaigns.

Our recommendation

• Inventory all WordPress sites using Ultimate Member and record their versions.
• Update to the latest 2.14.x release as a priority, starting with internet-facing sites.
• If an update is not possible, deactivate the plugin.
• Review user accounts and recent changes on affected sites as a precaution.
• Monitor the sites for suspicious activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory: PHP Object Injection in Ultimate Member patchstack.com
• VulDB entry CVE-2026-115968 vuldb.com
• OffSeq threat radar entry CVE-2026-115968 radar.offseq.com
• Ultimate Member release notes on GitHub github.com
• Ultimate Member on WordPress.org wordpress.org
• WPScan: active exploitation of Ultimate Member (2023 background) wpscan.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:13.