EUVD-2026-92042

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-96451

The Ultimate Member WordPress plugin, versions through 2.13.1 , is vulnerable to a Privilege Escalation issue due to an Authorization Bypass Through User-Controlled Key (CWE-639). This vulnerability allows an attacker to escalate privileges within the system. While specific exploit code and a dir...

CVE-2023-3460

Ultimate Member - Обзор Добро пожаловать в репозиторий Ultimate Member на GitHub! Ultimate Member — это мощный и гибкий плагин для создания профилей пользователей и подписок для WordPress, но иногда плагины содержат уязвимости, которые могут привести к компрометации сайта. Важное замечание:...

CVE-2024-1071

CVE-2024-1071 Неавторизованный доступ к базе данных / SQLi в Ultimate Member PoC теперь опубликован. Создано только для образовательных/исследовательских целей! Используйте на свой страх и риск!...

WordPress Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by thevietronin in WordPress Plugin Ultimate Member versions = 2.13.1...

CVE-2023-3460

CVE-2023-3460 Эксплойт для CVE-2023-3460 - неавторизованный административный доступ к плагину Ultimate Member. PoC теперь опубликован. Он был создан только для образовательных/исследовательских целей! Используйте его на свой страх и риск! Спасибо ©gbrsh, я немного улучшил инструмент...

WordPress-Exploit-CVE-2024-1071

워드프레스 CVE 2024-1071 SQL 익스플로잇 이 익스플로잇은 워드프레스 버전 2.1.3부터 2.8.2에서 실행되며, 인증되지 않은 공격자가 기존 쿼리에 추가 SQL 쿼리를 삽입하여 데이터베이스에서 민감한 정보를 추출할 수 있도록 합니다. Dork: body="/wp-content/plugins/ultimate-member" 1 git clone https://github.com/Dogu589/WordPress-Exploit-CVE-2024-1071.git cd WordPress-Exploit-CVE-2024-1071 ...

CVE-2024-1071-PoC-Script

CVE-2024-1071 Эксплойт-скрипт 🚀 🌟 Отказ от ответственности Данная концепция доказательства POC создана исключительно для образовательных и этических целей тестирования. Использование этого инструмента для атаки на цели без предварительного взаимного согласия незаконно. Ответственность за соблюден...

CVE-2023-3460_POC

CVE-2023-3460 Эксплойт для CVE-2023-3460 - неавторизованный доступ администратора к плагину Ultimate Member. Написан на Golang. ╔══════════════════════════════════════════════════╗ ╔══════════════════════════════════════════════════╗ ║ DISCLAIMER ║ ║ ABOUT THE PROJECT ║ ║ ║ ║ ║ ║ This Proof of...

CVE-2026-93428

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

CVE-2026-96270

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2023-3460

CVE-2023-3460 Эксплойт для CVE-2023-3460 - Несанкционированный доступ администратора к плагину Ultimate Member. PoC теперь опубликован. Он создан только в образовательных/исследовательских целях! Используйте его на свой страх и риск!...

CVE-2026-93428 Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

CVE-2026-93428

The Ultimate Member plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 2.13.1 . The root cause is the plugin's failure to properly verify user authorization when accessing the publicly available wp_ajax_nopriv_um_get_members endpoint. Specifically, t...

EUVD-2026-91881

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

EUVD-2026-91876

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-96270

The Ultimate Member plugin for WordPress (versions up to and including 2.13.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'form_id' parameter. The root cause is insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts...

CVE-2026-96270 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...

CVE-2023-3460

CVE-2023-3460 - Несанкционированный доступ администратора для плагина Ultimate Member POC Оценка CVSS: 9.1 Дата: 07/04/2023 Что такое плагин Ultimate Member? Плагин Ultimate Member — это популярный плагин членства для регистрации пользователей, у плагина 200 000+ активных установок. Быстрая...