CVE-2026-93428: Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wpajaxnoprivumgetmembers endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wplocalizescript, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote visitor can exploit it. The affected member-directory endpoint is publicly accessible, and the required um-frontend-nonce is exposed to unauthenticated visitors.
What information could be disclosed?
An attacker can view privacy-restricted member profile field values through the member directory. This includes fields configured as owner-only, members-only, or restricted to specific roles.
Does an attacker need an account or user interaction?
No. Exploitation requires neither authentication nor user interaction; an anonymous visitor can query the affected endpoint.
Which versions are affected?
All Ultimate Member versions up to and including 2.13.1 are affected.