PT-2026-51737 · Ultimate Member · The Ultimate Member – User Profile
Kevin Wydler
·
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-7761
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: (1) an MD5 hash fallback in get directory by hash() that allows any post to be used as a member directory by computing SUBSTRING(MD5(post id), 11, 5), (2) a strstr() parsing logic flaw in post data() that allows bypassing WordPress's protected meta key restrictions by placing ' um ' anywhere in the meta key name rather than at the start, and (3) missing field name validation in build user card data() that allows arbitrary field names including 'password reset link' to be passed to um filtered value(). This makes it possible for authenticated attackers with Contributor-level access and above to create a malicious post via XMLRPC with crafted meta fields, use the MD5 fallback to point the member directory AJAX handler to their post, inject 'password reset link' into the tagline fields configuration, and leak live password reset URLs for all users in the member directory response, including administrators.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
The Ultimate Member – User Profile