CVE-2026-96539: WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Q: Which installations are affected?

Ultimate Member versions through 2.13.1 are affected. The lower bound is listed as n/a, so the provided data does not identify an unaffected earlier version.

Q: What access does an attacker need?

The issue is network-accessible and does not require prior privileges or user interaction. Exploitation is rated as high complexity, indicating additional conditions or effort are required.

Q: What is the expected impact if exploitation succeeds?

The reported impact includes low-level effects on confidentiality, integrity, and availability. The vulnerability is rated medium severity with a CVSS score of 5.6.

Published Oct 9, 2026

Updated

Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

Affected Software

1 affected component

Ultimate Member Ultimate Member<=2.13.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Ultimate Member plugin to a version that resolves this vulnerability.
Fixed in 2.14.0

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Ultimate Member versions through 2.13.1 are affected. The lower bound is listed as n/a, so the provided data does not identify an unaffected earlier version.

What access does an attacker need?

The issue is network-accessible and does not require prior privileges or user interaction. Exploitation is rated as high complexity, indicating additional conditions or effort are required.

What is the expected impact if exploitation succeeds?

The reported impact includes low-level effects on confidentiality, integrity, and availability. The vulnerability is rated medium severity with a CVSS score of 5.6.

CVE-2026-96539: WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What is the expected impact if exploitation succeeds?