CVE-2026-115968

Summary

The Ultimate Member WordPress plugin before 2.13.2 contains a deserialization vulnerability (CWE-502) that allows unauthenticated remote attackers to inject arbitrary PHP objects via the 'um_remember_me' cookie, leading to potential remote code execution or data manipulation.

Exploitability

Exploitation is straightforward for authenticated users with no privilege requirements and does not require user interaction; however, successful exploitation depends on the availability of suitable gadget chains in the WordPress environment.

Blast radius

Successful exploitation could allow an attacker to execute arbitrary code on the server, compromise all site data, or fully take over the WordPress installation.

Detection

Monitor for unusual deserialization activity in PHP error logs (e.g., 'unserialize()' failures or unexpected object instantiation), anomalous 'um_remember_me' cookie values containing serialized data with suspicious class names, and unexpected file modifications or process spawns following authentication requests. No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Ultimate Member version 2.13.2 or later, which patches the deserialization vulnerability in the 'um_remember_me' cookie handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.