Ultimate Member 2.14.0 Vulnerabilities: PHP Object Injection, SQLi, Privilege Escalation, CVE-2026-96270

Vulnerability Overview Multiple security vulnerabilities exist in Ultimate Member version 2.14.0, including an unauthenticated PHP object injection vulnerability, an administrator-stored SQL injection vulnerability, an unauthenticated bypass of behavioral workflow execution, CVE-2026-96270, CVE-2026-93428, a privilege escalation vulnerability, an validation issue in the social link field, and a unique email validation issue. Scope of Impact PHP Object Injection Vulnerability: Unauthenticated attackers can exploit this vulnerability to execute arbitrary code. SQL Injection Vulnerability: Administrators can perform SQL injection via directory search field identifiers. Behavioral Workflow Vulnerability: Unauthenticated attackers can exploit this vulnerability to bypass behavioral workflows. CVE-2026-96270: The form ID attribute was not properly sanitized during Ultimate Member form submission. CVE-2026-93428: Field privacy was not correctly enforced when displaying user profile fields. Privilege Escalation Vulnerability: Issues existed with user account submission and nonces; users were reset if they lacked permission to download files. Social Link Field Validation Issue: There was a problem with the validation for social link fields. Unique Email Validation Issue: The primary email field and secondary email field did not ensure uniqueness. Remediation PHP Object Injection Vulnerability: The function has been added. SQL Injection Vulnerability: Search fields are now sanitized. Behavioral Workflow Vulnerability: Unique nonces and attributes have been added. CVE-2026-96270: The form ID attribute is now sanitized during Ultimate Member form submission. CVE-2026-93428: Field privacy issues when displaying user profile fields have been fixed. Privilege Escalation Vulnerability: Security issues with user account submission and nonces have been fixed; users without download permissions have been reset. Social Link Field Validation Issue: The validation for social link fields has been fixed. Unique Email Validation Issue: The primary and secondary email fields are now parsed and verified to ensure uniqueness. Templates Requiring Update Deprecations The and functions have been deprecated. It is recommended to use WordPress native functions , , and instead. The and localization data have been deprecated, as they are now localized for UM scripts. The class has been deprecated and is no longer used in UM core or extensions. The hook, used for handlers, has been deprecated. Marked for imminent deprecation: The attribute in the UM Form Builder. Notes After upgrading, you must refresh/regenerate caches and optimize/minimize assets (JS/CSS).

Goal Reached Thanks to every supporter — we hit 100%!

Ultimate Member 2.14.0 Vulnerabilities: PHP Object Injection, SQLi, Privilege Escalation, CVE-2026-96270

More from this source