PT-2025-52548 · WordPress · Ultimate Member

Athiwat Tiprasaharn · Published 2025-12-20 · Updated 2025-12-20 · CVE-2025-12492

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ultimate Member plugin for WordPress versions prior to 2.11.1

Description The Ultimate Member plugin for WordPress is affected by a sensitive information exposure issue. Insufficient authorization checks on an unauthenticated AJAX endpoint, combined with the use of a predictable low-entropy token, allows unauthenticated attackers to extract sensitive data. This data includes usernames, display names, user roles (including administrator accounts), profile URLs, and user IDs. The issue stems from the ajax get members function and the use of a predictable token (5 hex characters derived from md5 of post ID) to identify member directories. Attackers can enumerate predictable directory id values or brute-force the token space to access this information.

Recommendations Update the Ultimate Member plugin to version 2.11.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-12492

Affected Products

Ultimate Member

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-12492 · Security Note
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-member-directory.php#L205 · Note
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-ajax-common.php#L61 · Note
• https://twitter.com/CVEnew/status/2002466742195421568 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002314989743263895 · Twitter Post
• https://t.me/cveNotify/146440 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/61337d2d-d15a-45f2-b730-fc034eb3cd31?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/class-functions.php#L41 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3421362%40ultimate-member%2Ftrunk&old=3408617%40ultimate-member%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/40341 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/templates/members.php#L26 · Note
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.10.6/includes/core/class-member-directory.php#L2795 · Note