Ultimate Member registration permits administrator-equivalent capability assignment
Ultimate Member 2.6.7 through 2.12.x validates a submitted registration role against all registered site roles when it cannot resolve the form's own allow-list. An unauthenticated registrant can select a role with arbitrary capabilities and reach administrator-equivalent access.
- Component
- Ultimate Member
- Plugin slug
ultimate-member- Affected
- 2.6.7 to < 2.13.0
- Safe version
2.13.0- Published
- Aug 28, 2026
This CVE was published Aug 28, 2026 and is one of 60 known issues for this plugin.
Update, patch or deactivate.
Update Ultimate Member to 2.13.0 or later and audit registration forms, new accounts, assigned roles and administrator-equivalent capabilities.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H