CVE-2026-19423: Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ultimate Member (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.13.0 - Compensating control
Ensure role selection on Ultimate Member profile forms cannot be used by unauthenticated users to set roles/capabilities outside the form's allow-list (e.g., constrain the role field handling so it validates against the form's permitted roles rather than only against site-registered role names).
Event History
Frequently Asked Questions
Which installations are exposed?
Sites using Ultimate Member versions 2.6.7 through 2.12.1 are affected when users can register through the plugin's own profile form. Version 2.13.0 is not described as affected.
What does an attacker need to exploit this issue?
The attacker does not need to be authenticated. They need to register through an Ultimate Member profile form where the plugin cannot resolve the roles permitted by that form.
What level of access could exploitation provide?
An attacker can submit a role value that is checked against roles registered on the site rather than the form's allowed roles. This can grant arbitrary capabilities and lead to administrator-equivalent access.
What should be prioritized if remediation cannot happen immediately?
The available information identifies registration through Ultimate Member profile forms as the attack path. Prioritize restricting or disabling access to those registration forms until the plugin can be updated to 2.13.0 or later.