CVE-2026-19251: Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
Published Sep 2, 2026
·Updated
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.
Affected Software
1 affected component
Ultimate Member Ultimate Member WordPress plugin<2.13.0
Event History
Sep 2, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Unauthenticated visitors can exploit it. No login is required to retrieve affected profile activity.
2
What information may be exposed?
The issue can disclose the content of comments that are still awaiting moderation in profile activity. It can also return activity associated with profiles that are private.
3
Are private profiles and unapproved comments protected by the affected versions?
No. Versions before 2.13.0 do not verify comment approval status or whether the associated profile is private before returning profile activity to unauthenticated visitors.