PT-2026-27918 · WordPress · Ultimate Membership Pro

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-25357

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions azzaroco Ultimate Membership Pro versions n/a through 13.7

Description An authentication bypass issue exists in azzaroco Ultimate Membership Pro indeed-membership-pro, allowing for authentication abuse. The issue involves using an alternate path or channel to bypass normal authentication procedures.

Recommendations Versions prior to 13.8 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-25357

Affected Products

Ultimate Membership Pro

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25357 · Security Note
• https://twitter.com/CVEnew/status/2038517002156093637 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/indeed-membership-pro/vulnerability/wordpress-ultimate-membership-pro-plugin-13-7-account-takeover-vulnerability?_s_id=cve · Note