CVE-2026-96451— WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
Quick assessment
Affected
Ultimate Member Ultimate Member
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
用户可控密钥绕过授权漏洞存在于 Ultimate Member（终极会员）插件中，该漏洞可导致权限提升。此问题影响 Ultimate Member 插件的所有版本，从未知版本至 2.13.1 版本。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Ultimate Member | Ultimate Member | ≤ 2.13.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96451
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Ultimate Member | Ultimate Member | 0 ~ 2.13.1 | - |
|
II. Public POCs for CVE-2026-96451
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96451
请登录查看更多情报信息。
Other References for CVE-2026-96451 (1)
IV. Related Vulnerabilities
Same product: Ultimate Member
-
CVE-2026-62059
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection v -
CVE-2026-85680
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Pr -
CVE-2026-19251
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Commen -
CVE-2026-19423
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege E -
CVE-2026-12251
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalat
Same vendor: Ultimate Member
-
CVE-2026-62059
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection v -
CVE-2020-37169
WordPress Plugin ultimate-member 2.1.3 Local File Inclusion -
CVE-2025-67474
WordPress ForumWP plugin <= 2.1.4 - Broken Access Control vu -
CVE-2025-47691
WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Funct -
CVE-2024-54367
WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vul
Same weakness: CWE-639
-
CVE-2026-11399
Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - In -
CVE-2026-105029
UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTic -
CVE-2026-39444
WordPress PublishPress Series plugin <= 3.1.3 - Insecure Dir -
CVE-2026-104449
YesWiki before 4.6.7 Unauthenticated Page Overwrite via Baza -
CVE-2026-104444
YesWiki before 4.6.7 Authorization Bypass via Comments API e
V. Comments for CVE-2026-96451
No comments yet