CVE-2026-93428 Missing authorization in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

What is CVE-2026-93428?

CVE-2026-93428 is a high-severity missing authorization vulnerability in ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, published on 3 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.

Weakness: CWE-862

Which versions are affected by CVE-2026-93428?

How do I fix CVE-2026-93428?

No fix has been published for CVE-2026-93428 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-93428 being exploited?

There is no known exploitation of CVE-2026-93428 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mx72-jqqr-rmpp.