This vulnerability (CVE-2026-25357) in azzaroco Ultimate Membership Pro allows an attacker to bypass authentication mechanisms by leveraging an alternate path or channel. It affects versions up to 13.7 and results in authentication abuse. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or mitigation details are currently provided by the vendor or advisory sources.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authentication controls, gaining unauthorized access to protected resources or administrative functions within the Ultimate Membership Pro plugin. This could lead to full compromise of the affected system's data and operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin or implementing compensating controls such as web application firewalls or access restrictions to reduce exposure.