Ultimate Member vulnerability: is your WooCommerce store affected?

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

1. PHP object injection

   In some setups, someone could make your server run code.

   Score 9.8 (critical)no login neededAffected: older than 2.14.0Fixed in 2.14.0Published 28 October 2026CVE-2026-115968

   Advisory: Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

2. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 8.8 (high)needs only a customer accountAffected: older than 2.14.0Fixed in 2.14.0Published 2 October 2026CVE-2026-96451

   Advisory: Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

3. Missing permission check

   An action that should need permission could be done without it.

   Score 7.5 (high)no login neededAffected: older than 2.14.0Fixed in 2.14.0Published 2 October 2026CVE-2026-93428

   Advisory: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,...

4. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 2.14.0Fixed in 2.14.0Published 2 October 2026CVE-2026-96270

   Advisory: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all...

5. Account takeover

   Someone could log in as another user, an admin included, without their password.

   Score 8.8 (high)needs only a customer accountAffected: older than 2.12.0Fixed in 2.12.0Published 23 June 2026CVE-2026-7761

   Advisory: The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4.

6. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 7.5 (high)no login neededAffected: older than 2.10.2Fixed in 2.10.2Published 16 April 2025CVE-2026-15290

   Advisory: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind SQL Injection via the search parameter in all versions up...

7. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 7.5 (high)no login neededAffected: older than 2.10.1Fixed in 2.10.1Published 4 March 2025CVE-2025-1702

   Advisory: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all...

8. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 7.5 (high)no login neededAffected: older than 2.9.2Fixed in 2.9.2Published 17 January 2025CVE-2025-0308

   Advisory: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search parameter in all...

9. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 9.8 (critical)no login neededAffected: older than 2.8.3Fixed in 2.8.3Published 23 February 2024CVE-2024-1071

   Advisory: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to...

10. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 9.8 (critical)no login neededAffected: older than 2.6.7Fixed in 2.6.7Published 29 June 2023CVE-2023-3460

    Advisory: The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will.

7 older holes, published before 1 January 2023

1. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 9.8 (critical)no login neededAffected: older than 2.1.12Fixed in 2.1.12Published 9 November 2020CVE-2020-36155

   Advisory: An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.

2. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 9.8 (critical)no login neededAffected: older than 2.1.12Fixed in 2.1.12Published 9 November 2020CVE-2020-36157

   Advisory: An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles.

3. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 8.8 (high)needs only a customer accountAffected: older than 2.1.12Fixed in 2.1.12Published 9 November 2020CVE-2020-36156

   Advisory: An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update.

4. Account takeover

   Someone could log in as another user, an admin included, without their password.

   Score 8.8 (high)needs only a customer accountAffected: older than 2.0.40Fixed in 2.0.40Published 15 June 2019CVE-2019-10270

   Advisory: An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress.

5. Cross-site request forgery

   Someone could trick a logged-in admin into making a change.

   Score 8.8 (high)no login neededAffected: older than 2.0.40Fixed in 2.0.40Published 1 April 2019CVE-2019-10673

   Advisory: A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute...

6. File access

   Someone could read files on your server they should never see.

   Score 7.5 (high)no login neededAffected: older than 2.0.40Fixed in 2.0.40Published 10 May 2018CVE-2018-0588

   Advisory: Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.

7. Cross-site request forgery

   Someone could trick a logged-in admin into making a change.

   Score 8.8 (high)no login neededAffected: older than 2.0.7Fixed in 2.0.7Published 23 April 201867c2de20-0ec5-47cc-9458-a31bb6a4e9c8

   Advisory: The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Multiple Cross-Site Request Forgery Issues security vulnerability.

How to check your version

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find Ultimate Member. The version number is under its name. If it is lower than 2.14.0, your store is affected.
3. No login to hand? Open https://yourstore.com/wp-content/plugins/ultimate-member/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
2. On the copy, update Ultimate Member to 2.14.0 or newer: Dashboard > Updates, or Update now on the Plugins page.
3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use Ultimate Member.
5. If everything works, make the same update on the live store and place one more test order.
6. If you no longer use Ultimate Member, delete it instead of leaving it deactivated.

Questions

Which Ultimate Member version fixes it?

Version 2.14.0 or newer fixes all 17 issues on this page.

How do I know if my store is affected?

Your store is affected if it runs Ultimate Member older than 2.14.0. In WordPress, open Plugins and read the version under Ultimate Member. Without logging in, open yourstore.com/wp-content/plugins/ultimate-member/readme.txt and read the Stable tag line.

I don't use Ultimate Member any more. Is a deactivated copy safe?

Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.

Can someone fix it for me?

Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.