CVE-2026-12251
High
Description
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
SeverityHigh
CVSS8.1
Exploit probability—
ProductUltimate Member
PublishedJul 31, 2026
First seenJul 31, 2026
Weakness typeCWE-269Improper privilege management
How to fix
Update
- Ultimate Member2.12.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Ultimate Member | v < 2.12.1 | 2.12.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.