8.1
Élevée
CVE-2026-12251 The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it…
Description
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ultimate Member 2.12 | premières → < 2.12.1 | 2.12.1 |
Autres CVE de Ultimate Member
Les 6 CVE de Ultimate Member →
CVE-2026-85680
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names…
8.8
Élevée
CVE-2026-19251
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the…
5.3
Moyenne
CVE-2026-19423
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot…
8.1
Élevée
CVE-2026-11766
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea…
8.0
Élevée