PT-2025-51861 · WordPress · Ultimate Member

Boris Bogosavac · Published 2025-12-17 · Updated 2025-12-17 · CVE-2025-14081

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Ultimate Member plugin for WordPress versions prior to 2.11.1

Description The Ultimate Member plugin for WordPress has a flaw in its secure fields mechanism. Field keys are stored in the allowed fields list before the required perm check is applied during rendering. This allows authenticated attackers with Subscriber-level access to modify their profile privacy settings, such as setting profile visibility to "Only me," through direct parameter manipulation, even if the administrator has disabled this option for their role.

Recommendations Update The Ultimate Member plugin to version 2.11.1 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-14081

Affected Products

Ultimate Member

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14081 · Security Note
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/um-actions-account.php#L322 · Note
• https://plugins.trac.wordpress.org/changeset/3421362 · Note
• https://t.me/CVEtracker/40062 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-account.php#L610 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/aad57a68-c385-491f-a5a2-32906df4b52b?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2001401136377364536 · Twitter Post
• https://twitter.com/CVEnew/status/2001365738053939450 · Twitter Post