The Ultimate Member plugin for WordPress contains an authorization flaw (CWE-863) in its profile privacy settings mechanism. Specifically, field keys are added to the allowed fields list prior to enforcing the `required_perm` check during rendering. This logic error permits authenticated attackers with Subscriber privileges to alter their profile privacy settings, such as setting their profile visibility to "Only me," despite administrative restrictions. The vulnerability affects all versions up to and including 2.11.0 and has a CVSS 3.1 base score of 4.3 (medium severity).

An attacker with Subscriber-level access can bypass administrative restrictions on profile privacy settings by directly manipulating parameters. This could allow users to conceal their profiles contrary to configured policies, potentially impacting visibility and content restriction controls. There is no indication of confidentiality, availability, or higher integrity impacts beyond the limited profile privacy setting modification.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisory for updates and apply any official fixes once released. Until then, consider restricting Subscriber-level permissions or monitoring for suspicious profile privacy changes as a temporary mitigation.