8.1
High
CVE-2026-19423 The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot…
Description
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ultimate Member 2.6 | 2.6.7 → < 2.13.0 | 2.13.0 |
Other CVEs of Ultimate Member
The 6 CVEs of Ultimate Member →
CVE-2026-85680
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names…
8.8
High
CVE-2026-19251
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the…
5.3
Medium
CVE-2026-12251
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it…
8.1
High
CVE-2026-11766
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea…
8.0
High