CVE-2026-62059: WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Ultimate Member pluginto a version that resolves this vulnerability.Fixed in 2.14.0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires high privileges. It is remotely exploitable over the network, has low attack complexity, and does not require user interaction.
How can I tell whether my site is affected?
Check the installed Ultimate Member plugin version. The reported affected range includes versions through 2.13.1; no fixed version is identified in the provided data.
What impact could successful exploitation have?
The reported impact includes high confidentiality loss and low availability impact. Integrity impact is listed as none, while the scope may extend beyond the vulnerable component.