CVE-2026-93428

Summary

The Ultimate Member WordPress plugin fails to properly verify user authorization when accessing member profile fields, allowing unauthenticated attackers to view privacy-restricted data through the wp_ajax_nopriv_um_get_members endpoint. This authorization bypass affects all versions up to 2.13.1 and exposes sensitive member information including owner-only, members-only, and role-restricted fields.

Exploitability

Exploitation is straightforward with no prerequisites - attackers can directly query the publicly accessible endpoint without authentication, as the required nonce is exposed to all visitors via wp_localize_script.

Blast radius

The impact could be significant across all WordPress sites using the Ultimate Member plugin version 2.13.1 or earlier, potentially exposing private member profile information to anonymous users.

Detection

Monitor for unauthorized access attempts to wp_ajax_nopriv_um_get_members endpoint in web server logs, particularly GET requests with um_get_members action parameter, and watch for unusual traffic patterns to the /wp-admin/admin-ajax.php endpoint from unauthenticated users.

Prioritized remediation

Upgrade to version 2.13.2 or later to address this authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.