If you received an email from me pointing you to this page, it is because your website appears to be running a version of Ultimate Member (the WordPress membership and user-profile plugin by Ultimate Member, which lives in your files at /wp-content/plugins/ultimate-member/) that falls within the affected range of a known security issue. This page explains what the issue is, how to work out whether it applies to your site, how to read your version without being misled, and which version to update to.

The issue is CVE-2026-19423, an unauthenticated privilege-escalation weakness in the plugin’s registration and profile forms. It affects Ultimate Member versions 2.6.7 through 2.12.1 and is fixed in 2.13.0, released on 24 August 2026. If you are running a version in that range, update Ultimate Member to 2.13.0 or later. There is no CVSS score published for this issue (it was assigned by WPScan with no severity vector), so I am not going to quote you one, and I am not aware of any public exploit code for it.

Versions before 2.6.7 are not affected through this issue, and I want to be precise about that rather than let the notice sound broader than it is. This is not a flaw that has been present since the plugin’s beginning: the code path it relies on was introduced in 2.6.7. So an install older than 2.6.7 is not a target here, and I did not write to sites running one. If your version turns out to be below 2.6.7, you can disregard this notice for this issue (though keeping any plugin that far behind current up to date is worth doing for other reasons).

Before anything else, the qualifier that decides how much this matters for your site, because I would rather state it plainly than let the notice sound bigger than it is: this issue only reaches a site where one of your Ultimate Member registration or profile forms offers the person filling it in a choice of role, and where registration is open to the public. A standard Ultimate Member setup does not put a role selector on its registration form - an administrator has to add one deliberately - so many sites running an affected version are not exposed at all. I can read your plugin version from a public file, but I cannot see how your forms are built or whether registration is open, so this notice is a precautionary heads-up rather than a confirmed finding about your site.

A word on urgency, because this is a conditional notice. If none of your Ultimate Member forms lets a visitor pick a role, updating is ordinary plugin maintenance. If one of them does, and registration is open, please treat the update as a priority: in that configuration a visitor registering an account for themselves could assign that account elevated privileges, potentially up to an administrator-equivalent level, without any prior access to your site. That is a serious outcome where it applies, which is why I am writing rather than filing it as low priority - but it applies only under the conditions above, and updating removes it regardless of them.

This is a plugin flaw, not a WordPress core flaw. A fully up-to-date WordPress does not protect you if the Ultimate Member plugin itself is on an affected version.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, register on it, or exploit anything.

All I did was look at pages and files that your website serves to every visitor (the same way your homepage is public) and note the version number that the plugin publishes. I specifically did not create an account, submit a registration or profile form, log in, or send anything to the affected feature. Nothing about this check touches your data, your admin area, or any private part of your site (more detail under What I did and did not do below).

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

Why this matters

Ultimate Member builds the registration, login and member-profile pages on a great many WordPress sites. When someone registers, the plugin decides what role their new account should have. On a form that offers a role selector, it is supposed to accept only the roles that form was configured to allow.

In affected versions, when such a form’s list of permitted roles ends up empty, the plugin no longer discards the role the visitor submitted. Instead it keeps that value and checks it only against the roles your site happens to have - not against the roles the form was meant to offer. The consequence is that a visitor registering an account for themselves could steer it toward a role they were never meant to receive, up to an administrator-equivalent level.

The precondition, to repeat it because it is the part most likely to be misread in either direction: this needs a role selector on a public form, and open registration. Neither is the default. Ultimate Member’s stock registration form carries no role field, so on a typical install there is nothing here to reach. Where an administrator has added a role field and left registration open, the barrier is only as high as who can submit that form - which, with open registration, is anyone.

I am describing this at the level a site owner needs in order to act, and no further. I am not publishing the details that would let someone reproduce it, and I would ask you not to try it against your own site or anyone else’s. Reading your version number, and checking your own forms, as described below, tells you everything you need to decide what to do.

If my email cited this issue, it means the version your site reports is in the range 2.6.7 to 2.12.1. I did not test whether your particular site is exploitable, and I cannot see how your forms are built. All I observed is the version.

Am I affected?

Two questions decide it, in this order.

First: does any of your forms offer a role selector, with registration open?

This is the deciding question, and only you can answer it, because it depends on how your forms are built - which is not visible from outside. Checking is entirely safe and is the whole point of this page.

  1. In your WordPress dashboard, go to Ultimate Member then Forms, and open each of your registration and profile forms in turn.
  2. Look at the fields on each form for a role-selection field (a dropdown or set of options that lets the person registering choose a role, sometimes labelled “Role”). On most sites there is none, because the standard registration form does not include one.
  3. Check whether registration is open to the public: Settings then General then Membership, the “Anyone can register” box (WordPress core), and whether your Ultimate Member registration form is reachable by visitors.
  4. If no form offers a role selector, this issue does not reach your site, even on an affected version - though updating is still worth doing as ordinary maintenance.
  5. If any form offers a role selector and registration is open, treat the update as a priority (see How to upgrade). If you cannot update immediately, the interim step is to remove the role field from any public-facing registration or profile form, or close public registration, until you have updated. Updating is the actual fix.

Please do not try to reproduce the problem against your own site or anyone else’s; you do not need to in order to answer the question above.

Second: which version are you running?

You do not have to take my word for it. There are two public ways to read your version and one inside the dashboard, and they should agree.

From the WordPress admin area (authoritative):

  1. Log in to your WordPress dashboard (usually at yourdomain.com/wp-admin).
  2. Go to Plugins then Installed Plugins.
  3. Find Ultimate Member, the entry whose folder is ultimate-member, and note the version shown beneath its name.

From the public manifest (no login needed): open

yourdomain.com/wp-content/plugins/ultimate-member/readme.txt

in a browser, and read the Stable tag: line near the top. This is the public source I read. If that address returns a “not found”, try README.txt with capital letters - some hosts are case-sensitive and a few packages ship the file capitalised.

From your page source (no login needed): view the source of your home page and look for the plugin’s own stylesheets at exactly these paths:

/wp-content/plugins/ultimate-member/assets/css/um-styles.min.css?ver=...
/wp-content/plugins/ultimate-member/assets/css/um-profile.min.css?ver=...

The ?ver= number attached to those files is the plugin’s own version. Ultimate Member loads these stylesheets on every front-end page by default, whether or not the page shows a member area, so your home page is usually enough.

The trap to avoid here, and it is an easy one to fall into. Ultimate Member ships bundled copies of several third-party libraries inside its own plugin folder, and each of those carries its own, entirely unrelated version number. Your page source may show a cropper library at ?ver=1.6.1, Font Awesome at ?ver=6.5.2, or Select2 at ?ver=3.6.2, all on paths that begin with the Ultimate Member plugin folder. An operator who searches the page source for the plugin folder and reads the first ?ver= value that turns up can easily come away with one of those numbers, which has nothing to do with the plugin’s version. Read the version only off the plugin’s own um- stylesheets (um-styles, um-profile, um-account, and the like), and ignore every other ?ver= in the page. If you cannot get a readable number out of the page source at all, that is common and is not a sign of anything - caching and optimisation plugins routinely strip the ?ver= value - so use the readme.txt or the admin screen instead.

Then apply this rule, and note that versions compare numerically, not alphabetically, so 2.12.1 is newer than 2.6.7 even though “12” looks smaller than “6” as text:

  • 2.6.7 through 2.12.1: affected, subject to the form question above. Update to 2.13.0 or later.
  • 2.13.0 or newer: already fixed as far as this issue is concerned. Taking the latest available version is the best move.
  • Anything older than 2.6.7: not affected through this issue. Updating is still worth doing as ordinary maintenance.

How to upgrade

The plugin is free, still published, and actively maintained, so the fix is a normal update. The safest path is to update through WordPress itself, and to back up first:

  1. Back up your site (files and database) before making changes. Most hosting providers offer one-click backups, or use a WordPress backup plugin.
  2. In the WordPress admin, go to Dashboard then Updates, or Plugins then Installed Plugins. If an Ultimate Member update is listed, install it from here.
  3. If you prefer the command line, WP-CLI does the same thing: wp plugin update ultimate-member (the command uses the folder name, not the display name).
  4. If no update appears, you can get the latest release directly from the plugin’s page on the WordPress.org directory, Ultimate Member, and update via Plugins then Add New Plugin then Upload Plugin.
  5. After updating, confirm the new version number (2.13.0 or later) using the steps above, and register a test account (or check your existing member and registration flows) to make sure they still work as expected.

While you are in there, it is worth confirming that WordPress core and your other plugins are up to date, since the same principle applies to all of them.

After updating: was this already used against you?

Updating to 2.13.0 or later closes the issue, and for many sites that is the whole task. This page is a precautionary notice, not an incident report: I have no visibility into whether anything happened on your site, and I did not look.

One follow-up is worth doing, and it is conditional on the same form question. Because the outcome of this issue, where it applies, is an account with elevated privileges, then if your site had a registration or profile form offering a role selector while registration was open and you were running an affected version, it is worth confirming that nobody used it to create an account they should not have:

  • Review your user accounts, especially administrators. In Users then All Users, filter by Administrator (and any other high-privilege roles) and look for accounts you do not recognise, or accounts created around or after the time you were on an affected version. Pay attention to recently registered users whose role is higher than a normal member.
  • If you find an account you cannot account for, treat it as you would any suspected unauthorised access: remove or demote it, force a password reset for your administrators, and if your organisation has an IT security team, loop them in.
  • If everything looks as it should, and especially if no form offered a role selector in the first place, updating alone is enough.

To be clear about the framing: this is a self-check, not a declaration that your site was attacked. This notice is based on a version number, not on any evidence of an incident.

What I did and did not do

To be fully transparent about the check behind my email: I only read files that your site already serves to every visitor, specifically your home page and the addresses of the Ultimate Member stylesheets written into it, and the plugin’s public readme.txt inside wp-content/plugins/ultimate-member/. I did not access your WordPress admin area, your database, your form configuration, or any private part of the site.

In particular, I never created an account, submitted your registration or profile form, logged in, or sent anything to the affected feature. Nothing was submitted, tested, or exploited. That matters here, because a registration submission is close to the exact action this issue concerns, so “I did not touch it” is the whole difference between a disclosure and an intrusion.

I am also deliberately not publishing the details that would help someone act on this issue. The description above stops at the level a site owner needs, and I do not link any proof-of-concept code.

This is a version-based observation: your site reports a version in the range 2.6.7 to 2.12.1. It is not a statement that your site was exploitable at the time I checked. Because this issue depends on how your forms are built and whether registration is open - things I cannot see - a site in the affected range may well not be exposed at all, and a site in that range may separately be protected by other means such as a web application firewall or a backported fix. If you have already updated, or otherwise remediated this, no action is needed, and I apologise for the noise.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor / plugin