EUVD-2026-92042

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-96451

The Ultimate Member WordPress plugin, versions through 2.13.1 , is vulnerable to a Privilege Escalation issue due to an Authorization Bypass Through User-Controlled Key (CWE-639). This vulnerability allows an attacker to escalate privileges within the system. While specific exploit code and a dir...

CVE-2023-3460

Ultimate Member - Обзор Добро пожаловать в репозиторий Ultimate Member на GitHub! Ultimate Member — это мощный и гибкий плагин для создания профилей пользователей и подписок для WordPress, но иногда плагины содержат уязвимости, которые могут привести к компрометации сайта. Важное замечание:...

CVE-2024-1071

CVE-2024-1071 Неавторизованный доступ к базе данных / SQLi в Ultimate Member PoC теперь опубликован. Создано только для образовательных/исследовательских целей! Используйте на свой страх и риск!...

WordPress Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by thevietronin in WordPress Plugin Ultimate Member versions = 2.13.1...

CVE-2023-3460

CVE-2023-3460 Эксплойт для CVE-2023-3460 - неавторизованный административный доступ к плагину Ultimate Member. PoC теперь опубликован. Он был создан только для образовательных/исследовательских целей! Используйте его на свой страх и риск! Спасибо ©gbrsh, я немного улучшил инструмент...

WordPress-Exploit-CVE-2024-1071

워드프레스 CVE 2024-1071 SQL 익스플로잇 이 익스플로잇은 워드프레스 버전 2.1.3부터 2.8.2에서 실행되며, 인증되지 않은 공격자가 기존 쿼리에 추가 SQL 쿼리를 삽입하여 데이터베이스에서 민감한 정보를 추출할 수 있도록 합니다. Dork: body="/wp-content/plugins/ultimate-member" 1 git clone https://github.com/Dogu589/WordPress-Exploit-CVE-2024-1071.git cd WordPress-Exploit-CVE-2024-1071 ...

CVE-2024-1071-PoC-Script

CVE-2024-1071 Эксплойт-скрипт 🚀 🌟 Отказ от ответственности Данная концепция доказательства POC создана исключительно для образовательных и этических целей тестирования. Использование этого инструмента для атаки на цели без предварительного взаимного согласия незаконно. Ответственность за соблюден...

CVE-2023-3460_POC

CVE-2023-3460 Эксплойт для CVE-2023-3460 - неавторизованный доступ администратора к плагину Ultimate Member. Написан на Golang. ╔══════════════════════════════════════════════════╗ ╔══════════════════════════════════════════════════╗ ║ DISCLAIMER ║ ║ ABOUT THE PROJECT ║ ║ ║ ║ ║ ║ This Proof of...

CVE-2026-92536

The ProfilePress plugin for WordPress (all versions up to and including 4.17.4 ) is vulnerable to Sensitive Information Exposure via the get_user_profile_structure function. Authenticated attackers with subscriber-level access or higher can extract other users' email addresses, login names, and r...

EUVD-2026-91890

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

CVE-2026-92536 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

S2-053-CVE-2017-12611

S2-053-CVE-2017-12611 Простой скрипт для эксплуатации RCE в Struts 2 S2-053CVE-2017-12611 Использование exploit.py Пример $ python s2-053-exploit.py "http://127.0.0.1" "name" "uname -a" Generated EXP:...

CVE-2026-93428

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

CVE-2026-96270

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2023-3460

CVE-2023-3460 Эксплойт для CVE-2023-3460 - Несанкционированный доступ администратора к плагину Ultimate Member. PoC теперь опубликован. Он создан только в образовательных/исследовательских целях! Используйте его на свой страх и риск!...

CVE-2026-93428 Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

CVE-2026-93428

The Ultimate Member plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 2.13.1 . The root cause is the plugin's failure to properly verify user authorization when accessing the publicly available wp_ajax_nopriv_um_get_members endpoint. Specifically, t...

EUVD-2026-91881

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

EUVD-2026-91876

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...