CVE-2026-19423highCWE-269

CVE-2026-19423: fallo de gravedad alta en Ultimate Member

Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms

Publicada el

Seguir esta CVE+ Monitorear Ultimate Member

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 8.1epss 0.4%
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Unknown · Ultimate Member
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Ultimate Member

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-3460—Ultimate Member < 2.6.7 - Unauthenticated Privilege EscalationEPSS 72.3%CVE-2026-85680HIGHUltimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page TitleEPSS 0.5%CVE-2026-11766HIGHUltimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile FieldsEPSS 0.4%CVE-2026-12251HIGHUltimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection FieldEPSS 0.4%CVE-2026-19251MEDIUMUltimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile ActivityEPSS 0.3%