CVE-2026-7761: Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: (1) an MD5 hash fallback in getdirectorybyhash() that allows any post to be used as a member directory by computing SUBSTRING(MD5(postid), 11, 5), (2) a strstr() parsing logic flaw in postdata() that allows bypassing WordPress's protected meta key restrictions by placing 'um' anywhere in the meta key name rather than at the start, and (3) missing field name validation in buildusercarddata() that allows arbitrary field names including 'passwordresetlink' to be passed to umfilteredvalue(). This makes it possible for authenticated attackers with Contributor-level access and above to create a malicious post via XMLRPC with crafted meta fields, use the MD5 fallback to point the member directory AJAX handler to their post, inject 'passwordresetlink' into the taglinefields configuration, and leak live password reset URLs for all users in the member directory response, including administrators.