What’s Vulnerable › Vulnerabilities
CVE-2026-12251: Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-31 · updated 2026-08-26
- Weakness: CWE-269
Description
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
Affected products
- ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P: before 2.12.1 — fixed in 2.12.1
How to fix
Upgrade to a fixed version: ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P 2.12.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-12251 or the next vulnerability affects your stack