CVE-2026-115968: WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/ultimate-memberto a version that resolves this vulnerability.Fixed in 2.14.0
Event History
Frequently Asked Questions
Which installations are affected?
Ultimate Member installations running any affected version through 2.13.1 are impacted. The available data does not identify a safe fixed version.
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the potential impact of successful exploitation?
The reported severity is critical, with high impact to confidentiality, integrity, and availability. The vulnerability is described as PHP object injection through deserialization of untrusted data.