The Ultimate Member plugin for WordPress, versions up to and including 2.8.6, suffers from a CSRF vulnerability (CWE-352) due to missing or incorrect nonce validation on admin_init or user_action_hook functions. This flaw enables unauthenticated attackers to alter membership status by exploiting the trust of site administrators through forged requests, such as malicious links. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no information about an available patch or vendor advisory in the provided data.

An attacker can modify a user's membership status without authentication by exploiting the CSRF vulnerability if they can trick a site administrator into performing an action like clicking a crafted link. This impacts the integrity of membership data but does not affect confidentiality or availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links and consider implementing additional CSRF protections or restrictions on administrative actions if possible.