CVE-2026-19423

Ultimate Member before 2.13.0 mishandles role validation: when the plugin cannot resolve the set of roles a profile or registration form permits, it screens the submitted role value against the site's registered role names instead of the form's own allow-list (CWE-269, improper privilege management). An unauthenticated attacker who registers through the plugin's own registration form can therefore submit an arbitrary role name, such as administrator, and have it accepted. This grants the attacker arbitrary capabilities and administrator-equivalent access on the affected WordPress site without any credentials. Any WordPress site running Ultimate Member prior to 2.13.0 is affected, though practical exploitability depends on per-site form configuration where the permitted role set cannot be resolved, consistent with the elevated attack complexity in the 8.1 CVSS score. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time, and EPSS estimates roughly a 0.3% probability of exploitation within 30 days.

What to do: Upgrade Ultimate Member to version 2.13.0 or later. Until patched, restrict or remove role-selection fields from registration and profile forms, and audit existing user accounts—especially recently registered ones—for unexpected administrator or other elevated roles. Site owners should also review which roles each Ultimate Member form is configured to permit and verify that low-privileged users have not self-assigned higher-privilege roles.