The Ultimate Member plugin for WordPress suffers from an information exposure vulnerability in the ajax_get_members function. The vulnerability arises because the plugin uses a predictable 5-hex-character token derived from an MD5 hash of the post ID to identify member directories. This token space is small (16^5), enabling brute-force or enumeration attacks. Additionally, the AJAX endpoint lacks proper authorization checks, allowing unauthenticated attackers to retrieve sensitive user data including usernames, display names, user roles (including administrators), profile URLs, and user IDs. This vulnerability affects all versions up to and including 2.11.0.

An unauthenticated attacker can extract sensitive user information such as usernames, display names, user roles (including administrator roles), profile URLs, and user IDs. This exposure could facilitate further targeted attacks or social engineering but does not directly allow modification or denial of service. The CVSS score is 5.3 (medium), reflecting the confidentiality impact without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the ajax_get_members endpoint if possible or implement additional access controls at the web server or application firewall level to prevent unauthenticated access. Monitor vendor channels for updates and apply official fixes once released.