{"schema":"threatline.record/2","record":{"id":"CVE-2026-93428","aliases":[],"summary":"Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass","details":"The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.","categories":["Unclassified"],"product":"Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","vendor":"ultimatemember","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93428","source_modified_at":"2026-10-03T15:42:46.923Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","vendor":"ultimatemember","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.13.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00515,"percentile":0.43019,"score_date":"2026-10-23"},"published_at":"2026-10-03T02:25:36.239Z","modified_at":"2026-10-03T15:42:46.923Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-93428","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-03T15:42:46.923Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93428","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde81421-e080-4530-87a5-6515f1c9800b?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-member-directory.php#L2795"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-member-directory.php#L2839"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-fields.php#L144"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/um-actions-profile.php#L1319"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-ajax-common.php#L61"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/um-short-functions.php#L1579"},{"source":"CVE List","url":"https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.0"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-03T15:36:33.111395Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-03T15:42:46.923Z","content_hash":"4f2253e2fe01022791befa67376d70f5e7c7395d15c589996bbc93c83d1e622b"}}