CVE-2026-96451highCWE-639

CVE-2026-96451: high-severity vulnerability in Ultimate Member

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Published · Updated

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.8epss 0.3%
from disclosure to weapon1 days
Published on NVDOct 3
1st PoC+1d
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Ultimate Member · Ultimate Member
public PoCs found — 2
githubgithub.com/Nxploited/CVE-2026-96451★ 0githubgithub.com/MRdark-ops/wpexploit-CVE-2026-96451★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Ultimate Member

In the same product, most dangerous first.

CVE-2018-0588—CVE-2018-0588EPSS 2.6%CVE-2018-0586—CVE-2018-0586EPSS 1.6%CVE-2018-0589—CVE-2018-0589EPSS 1.1%CVE-2018-0590—CVE-2018-0590EPSS 1.1%CVE-2018-0587—CVE-2018-0587EPSS 1.1%CVE-2018-0585—CVE-2018-0585EPSS 1.0%
References
https://patchstack.com/database/wordpress/plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-13-1-privilege-escalation-vulnerability?_s_id=cve