Description

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:16.740Z",
  "pubdate": "2026-09-02T06:17:16.740Z",
  "executiveSummary": "The Ultimate Member WordPress plugin, in versions prior to 2.13.0, contains an improper access control vulnerability that results in unauthorized information disclosure.\nThe vulnerability allows unauthenticated remote attackers to retrieve the content of comments that are currently pending administrative moderation.\nThis flaw specifically affects the profile activity stream functionality, where the system fails to validate the approval status of comments or the privacy settings of the associated user profiles before rendering data to the client.\nBy accessing exposed endpoints, an unauthenticated user can bypass standard WordPress moderation workflows, potentially leading to the leakage of sensitive, private, or inappropriate user-generated content that was intended to remain hidden until reviewed.\nThe risk implication is significant as it undermines the privacy model of the platform, potentially exposing internal communications or unpublished user discussions to the public internet.\nExploitation requires no authentication and can be performed via standard web requests to the vulnerable API or activity stream endpoints.\nUsers of the affected versions are at risk of data privacy breaches, and immediate remediation is required to ensure that access control checks are strictly enforced before sensitive profile activity data is returned to the requester.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient implementation of access control logic within the Ultimate Member plugin's activity stream processing functionality. Specifically, the software fails to integrate necessary conditional checks to verify the moderation status of comments during the retrieval process for profile activity feeds.\nIn the standard WordPress lifecycle, comments marked as 'pending' are withheld from public view to ensure that only approved content appears on the front end. The Ultimate Member plugin overrides or bypasses these standard checks when aggregating profile activity data. When a request is made to the profile activity endpoint, the underlying codebase executes a query to retrieve comment activity without filtering based on the 'comment_approved' field in the database.\nFurthermore, the vulnerability extends to the lack of privacy verification. The plugin fails to inspect whether the target profile is configured as 'private' before rendering its activity stream to an unauthenticated visitor. Consequently, the application returns serialized or rendered comment data regardless of the comment's publication status or the profile owner's privacy settings.\nThe attack flow is characterized by the following steps: First, an unauthenticated attacker identifies a target profile URL or the associated API endpoint used by the plugin to fetch activity streams. Second, the attacker sends an HTTP GET request to this endpoint. Third, the server-side application processes the request, retrieves the activity data from the database, and—due to the missing validation logic—includes pending comments and private activity data in the JSON or HTML response returned to the client. Fourth, the attacker parses the response, extracting the content of the moderated comments. The vulnerability is present in versions prior to 2.13.0 and necessitates that the activity feature is enabled for the profiles in question. Because this occurs at the controller level during the data fetching phase, no specific privilege escalation is required; the application treats the request as legitimate and returns the data that should otherwise be filtered by a standard WordPress access control check. The post-exploitation impact includes the unauthorized disclosure of potentially sensitive information that users intended to keep private, which can be leveraged for further social engineering or content scraping."
}