CVE-2026-4248 Information disclosure in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Authenticated contributors can expose administrator password reset tokens via shortcode templates, enabling account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-4248?
CVE-2026-4248 is a high-severity vulnerability in ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, published on 27 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the '{usermeta:password_reset_link}' template tag being processed within post content via the '[um_loggedin]' shortcode, which generates a valid password reset token for the currently logged-in user viewing the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to craft a malicious pending post that, when previewed by an Administrator, generates a password reset token for the Administrator and exfiltrates it to an attacker-controlled server, leading to full account takeover.
Weakness: CWE-285
Which versions are affected by CVE-2026-4248?
How do I fix CVE-2026-4248?
No fix has been published for CVE-2026-4248 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-4248 being exploited?
There is no known exploitation of CVE-2026-4248 in the wild and no public exploit code.
Sources
Also known as GHSA-65gh-443q-r8g2.