Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This… (CVE-2026-96451)

CVE-2026-96451 describes an authorization bypass vulnerability in the Ultimate Member plugin for WordPress, affecting versions up to 2.13.1. The issue involves a user-controlled key that can be manipulated to bypass authorization controls, resulting in privilege escalation. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an attacker with limited privileges to escalate their access rights, potentially leading to full control over the affected system's user management features. This can compromise confidentiality, integrity, and availability of the system.

No official patch or remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance before taking action. Until a fix is released, restrict access to the plugin and monitor for suspicious activity related to privilege escalation attempts.