Ultimate Member: Authorization bypass leads to privilege escalation

Summary

The Ultimate Member WordPress plugin up to and including version 2.13.1 contains an authorization bypass through a user-controlled key (CWE-639). An attacker with a low-privilege account, such as a Subscriber, can exploit it to gain administrator rights and take full control of the website. Patchstack rates the CVSS score as 8.8 and reports a public proof-of-concept.

Affected

• Ultimate Member WordPress plugin, versions from n/a through 2.13.1 (CVE record)
• Patchstack lists 2.13.1 and earlier as vulnerable; 2.13.0 and 2.13.1 are both affected
• Required privilege: Subscriber (Patchstack)

Fixed in

• Version 2.14.0 or later (Patchstack)
• Vendor advisory or changelog confirming this CVE: not found

Workaround

• Patchstack has issued a mitigation rule that blocks attacks until the site is updated (vendor-independent; does not replace the update)
• No vendor-published workaround found
• Unverified interim steps: disable open user registration, review accounts with unexpected roles (especially administrator), and restrict access to plugin functions until 2.14.0 is installed

Exploitation

• Public proof-of-concept code exists on GitHub (announced 4 Oct 2026); one tracker states no public exploit has been confirmed
• Not listed in CISA KEV according to a third-party tracker
• CISA SSVC: exploitation none, automatable no, technical impact total
• Patchstack considers exploitation likely and notes similar bugs are used in mass campaigns; this is its assessment, not a confirmed observation
• Attack requires no user interaction and low complexity

Our recommendation

• Identify all WordPress sites running Ultimate Member and update to version 2.14.0 or later immediately
• Do not rely on the 2.13.x line; it is affected
• Check for unexpected administrator accounts and unknown role changes
• Review whether public self-registration is enabled and disable it if not required
• Monitor web server logs for scanning or requests targeting the plugin
• Do not run unvetted third-party exploit code

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (2 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Nxploited/CVE-2026-96451 · MRdark-ops/wpexploit-CVE-2026-96451

Research sources

• Patchstack advisory patchstack.com
• Patchstack vulnerability entry patchstack.com
• Proof-of-concept repository by Nxploited github.com
• Rapid7 via Vulners vulners.com
• VulDB entry vuldb.com
• TheHackerWire tracker www.thehackerwire.com
• Strix CVE entry www.strix.ai
• Ultimate Member GitHub releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:37.