CVE-2026-115968

WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability

Ultimate Member Ultimate Member

Open in Threatline Record JSON

CVSS

9.8Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed inNone listedNo source names a fixed version yet

Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@offseq.bsky.social: CRITICAL deserialization flaw (CVSS 9.8) in Ultimate Member <2.14.0 lets attackers inject objects and compromise WordPress sites. Update to 2.14.0+ now! https://radar.offseq.com/thBluesky: CVE posts, 28 Oct 2026

Description

Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

Text from CVE List

Affected versions 1

Ultimate Memberaffected: all versions through 2.13.1CVE List

References 1

patchstack.com/database/wordpress/plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-13-1-php-object-injection-vulnerability?_s_id=cveReferencevia CVE List