CVE-2026-93428
Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
- Published
- Updated
- Reserved
- Assigned by
- Wordfence
Description
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WordfenceCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Deferred | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.52% · top 56% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
References (8)
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cde81421-e080-4530-87a5-6515f1c9800b?source=cve (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-member-directory.php#L2795 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-member-directory.php#L2839 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-fields.php#L144 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/um-actions-profile.php#L1319 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-ajax-common.php#L61 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/um-short-functions.php#L1579 (opens in a new tab)
- https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.0 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-93428)Record last updated .